Ability to configure session cookie, httponly by default

framework/web/Session.php

@@ -60,6 +60,13 @@ class Session extends Component implements \IteratorAggregate, \ArrayAccess, \Co
 	public $flashVar = '__flash';
 
 	/**
+	 * @var array parameter-value pairs to override default session cookie parameters
+	 */
+	public $cookieParams = array(
+		'httponly' => true
+	);
+
+	/**
 	 * Initializes the application component.
 	 * This method is required by IApplicationComponent and is invoked by application.
 	 */
@@ -111,6 +118,8 @@ class Session extends Component implements \IteratorAggregate, \ArrayAccess, \Co
 				);
 			}
 
+			$this->setCookieParams($this->cookieParams);
+
 			@session_start();
 
 			if (session_id() == '') {