session-cookie-httponly: Allow to disable httponly on session cookies
Merge branch 'release' into master
cors-csrf: Remove debug logging