Restore cookie session store httponly default to true

#1046 Http only cookies in CookieStore changed the cookie session store to default to httponly cookies. However, this default setting was lost when the cookie store was switched to a rack based session store. Both the Active Record session store and memcache session store currently default to httponly cookies.

This patch restores the default of httponly to true in the cookie session store and removes an extraneous .dup call on the options hash in initialize. Since #symbolize_keys is called on the options, which returns a new hash, the dup call isn't needed.