Changed various cookie_httponly to cookie_http_only to avoid breakage
changed various referer-check strings to check-referer to avoid breakage
initial tests for Session