Add httponly to config/pass to cookie settings
Merge branch 'session-http-only-config'