Ignoring case for Secure or HttpOnly sections of the cookie header.

We have some clients sending cookie headers on request with lower case secure and httponly bits. Simply ignoring case when checking for these situations.