Fix session cookie options

Set default `cookie_path` and correctly set `cookie_httponly`