Session cookie flags update ("secure" and "httpOnly" added where missing)

#### Steps to reproduce the issue
1. Using a tool which is able to display the "httpOnly" flag of a received cookie (an intercepting proxy or the Firebug Firefox add-on (I assume; the built-in Firefox console can't)), log-in and log-out of a site's back-end.

#### Expected result
1. Both, the session cookie is "set" and "delete" requests received as part of the server response have the "httpOnly" flag set.

#### Actual result
1. The "httpOnly" flag is not set.

#### System information (as much as possible)
PHP 5.3.6 on Apache on Linux

#### Additional comments
Added the "secure" and "httpOnly" flags to the cookie "delete" requests as well, as "Cookies must be deleted with the same parameters as they were set with" according to https://php.net/manual/en/function.setcookie.php.