[#1941] Subclass repoze.who AuthTktCookiePlugin.

Override _get_cookies to ensure the presence or absence of the HttpOnly
flag in each cookie value based on a new httponly property of the class.
[#1941] More robust get_cookies test
[#1941] Move middleware auth_tkt code to lib.

This puts the auth_tkt related code in the same place.
[#1941] Can set HttpOnly flag from config
[#1941] Docs and changelog for HttpOnly flag
Make help doc pass test
Merge branch 'master' into 1941-httponly
[#1941] More concise way to ensure HttpOnly
[#1941] Warn against setting httponly to False
[#1941] Tweak changelog for CORS and HttpOnly
Merge branch 'brew-1941-httponly'
Merge branch 'master' of github.com:ckan/ckan