Add httponly setting to cookies in check_login before session starts there too. Extension of pull #253

check_login.php

@@ -1,6 +1,8 @@
 <?php
 	
 	if(!isset($_SESSION)){
+    // HTTP Only cookies
+    ini_set("session.cookie_httponly", True);
     session_start();
 	}