php/php-src — pull request #664 by mj (2014-05-06 20:06:15+00:00)
Title: Streamlining of cookie handling in ext/session and setcookie

Up until now the session cookie used `HttpOnly` to indicate cookies only available through HTTP while setcookie() used `httponly`. The relevant [RFC 6265](http://tools.ietf.org/html/rfc6265) claims that case does not matter for this token, but only explicitly mentions `HttpOnly`. Thus this seems like a logical choice when streamlining the code.

Also the setcookie implementation now uses the same string constants as the session extension for other tokens like Max-Age or the domain attribute.

This change poses a slight risk of backwards incompatibility in places where people deliberately ignore [chapter 5.2.6 of RFC 6265](http://tools.ietf.org/html/rfc6265#section-5.2.6) and perform case-sensitive checks for the `HttpOnly` attribute.