adding HttpOnly and Secure cookie config options, fixes #83