Update session.php

Added php.ini directive session.cookie_httponly to help protect against XSS so javascript's document.cookie does not reveal the session ID