HttpOnly flag for repoze auth_tkt cookies

This adds (or removes) an HttpOnly flag on the repoze.who auth_tkt cookie depending on a new config setting `who.httponly`. The default is `True` if the setting is absent.

If `who.httponly = False`, the HttpOnly flag will be removed from the cookie if it's been previously set upstream (repoze.who's secure setting will set HttpOnly on, for example). This gives sys admins the option to allow access to the cookie by the DOM in exceptional circumstances (though not advised). 

This relates to issue #1941 and depends on PR #2048 being merged.

how about a strongly worded warning here about setting this to false, and maybe remove the example that does so.