Changed MongoEngineSessionInterface so it uses self.get_cookie_httponly() to decide wether it should mark the cookie as httponly or not.