session-cookie-httponly: Allow to disable httponly on session cookies