$wgCookieHttpOnly