Pr/3098

I've fixed up https://github.com/silverstripe/silverstripe-framework/pull/3098, rebased it, squashed the commits, fixed the test cases, and made a few API suggestions.
The default is `httpOnly` true now (see https://github.com/silverstripe/silverstripe-framework/commit/563155391f02dca5017dfc2a967eb1e93f0f1014), this should probably be set to true in all places through this file, yes?