Apply $wgCookieHttpOnly setting to the session cookie as well