Issue #139: Default session cookies to HTTP-only.

Add test to ensure default setting can be overridden.

Update one existing test that needs to know about the new HttpOnly flag.

Update other tests to assert only the relevant portion of the cookie. This
means they don't rely on...
  - the existence of flags they don't care about
  - the sort-order mechanics of the cookie encoding impl