TESTED! 
TESTED! 

setting httpOnly to true prevents javascript (and other script langs) from accessing it. 
setting secure to true sends the cookie over an secure connection (https) so that might not be a good default.
NathanBastiaans/emmaphp,bobdesaunois/emmaphp