Add httponly to config/pass to cookie settings

This was somehow not present - possibly by oversight?

See http://php.net/manual/en/function.session-set-cookie-params.php

PS. I don't know what's involved in upgrading the module version once this is merged etc., and/or if you want to do that at all.