When the auth_tkt plugin is passed secure=True, add HttpOnly to the cookie.

I'm not completely sure of this one, so adding it as a separate patch. It seems
reasonable in this case to always add the HttpOnly option whether secure is
True or False. But that may break sites needing to access the auth_tkt via JS.
But I cannot even imagine a sane usecase for that.

A third option would be to add an HttpOnly option to the plugin __init__ which
defaults to True.