HttpOnly flag for repoze auth_tkt cookies

This adds (or removes) an HttpOnly flag on the repoze.who auth_tkt cookie depending on a new config setting `who.httponly`. The default is `True` if the setting is absent.

If `who.httponly = False`, the HttpOnly flag will be removed from the cookie if it's been previously set upstream (repoze.who's secure setting will set HttpOnly on, for example). This gives sys admins the option to allow access to the cookie by the DOM in exceptional circumstances (though not advised). 

This relates to issue #1941 and depends on PR #2048 being merged.

@brew  Add these small tweaks and we are good to go
```diff
diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index ea7ee50..f07ae42 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -32,13 +32,13 @@ API changes and deprecations
 * Cross-Origin Resource Sharing (CORS) support is no longer enabled by
   default. Previously, Access-Control-Allow-* response headers were added for
   all requests, with Access-Control-Allow-Origin set to the wildcard value
-  ``*``. To re-enable CORS, use the new ``ckan.cors`` settings detailed in the
-  Config File Options documentation (:doc:`/maintaining/configuration`)
+  ``*``. To re-enable CORS, use the new ``ckan.cors`` configuration settings
+  (:ref:`ckan.cors.origin_allow_all` and :ref:`ckan.cors.origin_whitelist`).
 
 * The HttpOnly flag will be set on the authorization cookie by default. For
   enhanced security, we recommend using the HttpOnly flag, but this behaviour
   can be changed in the ``Repoze.who`` settings detailed in the Config File
-  Options documentation (:doc: `/maintaining/configuration`)
+  Options documentation (:ref:`who.httponly`).

```