Added AllowNonHttpOnlyCookies configuration option (false by default)