session-cookie-httponly: Allow to disable httponly on CMS session cookies