security: make FLASH cookie respect the HttpOnly config parameter
security: make ERRORS cookie respect the HttpOnly config parameter
Merge pull request #811 from codeborne/cookies-httponly

Respect HttpOnly setting for FLASH and ERRORS cookies