Streamlining of cookie handling in ext/session and setcookie

Up until now the session cookie used `HttpOnly` to indicate cookies only available through HTTP while setcookie() used `httponly`.  The relevant [RFC 6265](http://tools.ietf.org/html/rfc6265) claims that case does not matter for this token, but only explicitly mentions `HttpOnly`.  Thus this seems like a logical choice when streamlining the code.

Also the setcookie implementation now uses the same string constants as the session extension for other tokens like Max-Age or the domain attribute.

This change poses a slight risk of backwards incompatibility in places where people deliberately ignore [chapter 5.2.6 of RFC 6265](http://tools.ietf.org/html/rfc6265#section-5.2.6) and perform case-sensitive checks for the `HttpOnly` attribute.