httpserver: allow configuration of sessions/security and cookies

options passed to Server constructor accept the following new props:
- `sessions` (boolean) enable/disable sessions
- `security` (boolean) enable/disable security
- `cookieName` (string) optional cookie name
- `httpOnlyCookies` (boolean) enable/disable http-only for session cookies
- `secureCookies` (boolean) enable/disable secure flag for session cookies

`sessions` and `security` options were hardcoded before, which made overriding
the handlers of the server's default context (in jetty.xml) impossible.

in addition the object returned by `getContext()` now contains a getter
function for the wrapped ServletContextHandler (used in unit test).