nicktacular/php-mongo-session — pull request #12 by arski (2014-11-28 18:25:38+00:00)
Title: Add httponly to config/pass to cookie settings

This was somehow not present - possibly by oversight?

See http://php.net/manual/en/function.session-set-cookie-params.php

PS. I don't know what's involved in upgrading the module version once this is merged etc., and/or if you want to do that at all.