Added cookie settings
always set httponly (there is no good reason not to)
simplify httpsonly and expire flags
update docs