Fix session cookie options

Set default cookie_path and correctly set cookie_httponly
Merge pull request #170 from mlocati/fix-session-cookie-options

Fix session cookie options