Default session interceptor to http-only; fix tests.

Pursuing obsoleting this change by submitting a patch to Ring: https://github.com/ring-clojure/ring/issues/139

If that doesn't pan out, how do we want to document this change?