Add secure and httponly flags to setcookie()
Set $_is_started to false when the session is destroyed