HttpOnly flag for repoze auth_tkt cookies

This adds (or removes) an HttpOnly flag on the repoze.who auth_tkt cookie depending on a new config setting `who.httponly`. The default is `True` if the setting is absent.

If `who.httponly = False`, the HttpOnly flag will be removed from the cookie if it's been previously set upstream (repoze.who's secure setting will set HttpOnly on, for example). This gives sys admins the option to allow access to the cookie by the DOM in exceptional circumstances (though not advised). 

This relates to issue #1941.