Set session cookie as HttpOnly by default to protect against cookie theft

[villekuosmanen]

I noticed that the session cookies written in the SetCookie headers are not set by default. If this field is not set, the end users of this library are vulnerable to cookie theft by potential XSS attacks. OWASP recommends HttpOnly to be set for session cookies, which is why in my opinion it would be good practice to set the cookie by default in the library code.

Of course, you can set the flag manually by calling session.Options.HttpOnly = true before session.Save(r, w), but I doubt most users remember or understand that the field should be set by them (I only discovered this after doing some digging).

If you think this sounds like something the library should do, I don't mind sending out a PR for it, should be a one-line fix.

PS: Thanks for all the work you've done on the library :)

[antonlindstrom]

Hey! Thank you so much for taking the time to look at this and so sorry for the incredibly late reply.

As long as this doesn't break anything for existing users I am happy to take any PR to fix it.

Again, thank you so much!