Set httponly to be true for cookies

There's no reason to avoid this, http cookies allows protection against XSS attacks by not exposing them to JS and similar scripting languages. Since we don't manipulate cookies on a JS level it shouldn't affect us.

Set it to true by default, if an admin really wants he/she can disable it via ACP

Signed-off-by: Shitiz Garg <mail@dragooon.net>