Make session cookes HttpOnly and better file upload validation

Added php.ini directive session.cookie_httponly to help protect against XSS so javascript's document.cookie does not reveal the session ID