Configurable httponly flag for MongoEngineSessionInterface

I changed MongoEngineSessionInterface so it uses self.get_cookie_httponly() to decide wether it should mark the cookie as httponly or not. Without that it is not possible to create session cookies which can be used by javascript (e.g. SockJS cannot handle httponly cookies).