diff --git a/example/example.php b/example/example.php
index bf5dfa6..ade4b22 100644
--- a/example/example.php
+++ b/example/example.php
@@ -11,12 +11,12 @@ public function setUser(User $user)
     {
         $this->set('user', $user);
     }
-    
+
     public function hasUser()
     {
         return $this->has('user');
     }
-    
+
     public function getUser()
     {
         return $this->get('user');
diff --git a/example/example2.php b/example/example2.php
index ce04a43..c921c37 100644
--- a/example/example2.php
+++ b/example/example2.php
@@ -1,6 +1,6 @@
 <?php
 
-require '/home/steve/projects/session/src/autoload.php';
+require __DIR__ . '/../src/autoload.php';
 
 class Session extends spriebsch\session\AbstractSession
 {
@@ -14,7 +14,7 @@ public function incrementCounter()
         if (!$this->has('counter')) {
             $this->set('counter', 0);
         }
-    
+
         $this->set('counter', $this->get('counter') + 1);
     }
 }
diff --git a/src/AbstractSession.php b/src/AbstractSession.php
index 58bbc42..4f88309 100644
--- a/src/AbstractSession.php
+++ b/src/AbstractSession.php
@@ -100,7 +100,7 @@ public function __construct(SessionBackendInterface $backend)
     {
         $this->backend = $backend;
     }
-    
+
     public function configure($name, $domain, $path = '/', $lifetime = 300, $isSecure = FALSE)
     {
         if ($this->isStarted()) {
@@ -124,7 +124,7 @@ public function configure($name, $domain, $path = '/', $lifetime = 300, $isSecur
         $this->path = $path;
         $this->domain = $domain;
         $this->isSecure = $isSecure;
-        
+
         $this->isConfigured = TRUE;
     }
 
@@ -187,7 +187,7 @@ final protected function has($key)
     {
         return isset($this->data[$key]);
     }
-    
+
     /**
      * Checks whether the session has already been started
      *
diff --git a/src/PhpSessionBackend.php b/src/PhpSessionBackend.php
index c210ec3..225352c 100644
--- a/src/PhpSessionBackend.php
+++ b/src/PhpSessionBackend.php
@@ -54,7 +54,7 @@ class PhpSessionBackend implements SessionBackendInterface
     protected $domain;
     protected $isSecure;
 
-    public function startSession($name, $lifetime, $path, $domain, $isSecure = FALSE)
+    public function startSession($name, $lifetime, $path, $domain, $isSecure = FALSE, $httpOnly = TRUE)
     {
         $this->name = $name;
         $this->lifetime = $lifetime;
@@ -62,16 +62,16 @@ public function startSession($name, $lifetime, $path, $domain, $isSecure = FALSE
         $this->domain = $domain;
         $this->isSecure = $isSecure;
 
-        session_set_cookie_params($lifetime, $path, $domain, $isSecure, TRUE);
+        session_set_cookie_params($lifetime, $path, $domain, $isSecure, $httpOnly);
         session_name($name);
         session_start();
     }
-    
+
     public function getSessionId()
     {
         return session_id();
     }
-    
+
     public function regenerateSessionId()
     {
         session_regenerate_id(TRUE);
diff --git a/tests/AbstractSessionTest.php b/tests/AbstractSessionTest.php
index 4d990ac..52b97bf 100644
--- a/tests/AbstractSessionTest.php
+++ b/tests/AbstractSessionTest.php
@@ -64,26 +64,26 @@ class AbstractSessionTest extends PHPUnit_Framework_TestCase
 
     /**
      * @var string
-     */    
+     */
     protected $sessionName = 'a-session-name';
 
     /**
      * @var string
-     */    
+     */
     protected $sessionDomain = '.example.com';
     /**
      * @var string
-     */    
+     */
     protected $sessionId = 'a-session-id';
 
     /**
      * @var string
-     */    
+     */
     protected $newSessionId = 'a-new-session-id';
 
     /**
      * @var string
-     */    
+     */
     protected $value = 'a-value';
 
     /**
@@ -96,7 +96,7 @@ protected function setUp()
         $this->backend = $this->getMock('spriebsch\\session\\SessionBackendInterface');
         $this->session = new ConcreteSession($this->backend);
     }
-    
+
     /**
      * Destroys the test fixture.
      *
@@ -183,10 +183,10 @@ public function testStartStartsSessionInBackend()
         $this->backend->expects($this->once())
                       ->method('startSession')
                       ->with($this->sessionName, 300, '/', '.example.com');
-    
+
         $this->session->configure($this->sessionName, $this->sessionDomain);
         $this->session->start();
-        
+
         return $this->session;
     }
 
@@ -343,7 +343,7 @@ public function testRegenerateIdRegeneratesSessionIdInBackend()
         $this->session->configure($this->sessionName, $this->sessionDomain);
         $this->session->start();
         $this->session->regenerateId();
-        
+
         return $this->session;
     }
 
@@ -363,7 +363,7 @@ public function testSessionIdChangesWhenIdIsRegenerated()
 
         $this->session->configure($this->sessionName, $this->sessionDomain);
         $this->session->start();
-        
+
         $this->assertEquals($this->newSessionId, $this->session->regenerateId());
     }
 
@@ -375,21 +375,21 @@ public function testCommitThrowsExceptionWhenSessionIsNotStarted()
     {
         $this->session->commit();
     }
-    
+
     /**
      * @covers spriebsch\session\AbstractSession::commit
      */
     public function testCommitWritesSessionData()
     {
         $this->session->configure($this->sessionName, $this->sessionDomain);
-        $this->session->start(); 
-        
-        $this->session->setFoo('a-value');    
+        $this->session->start();
+
+        $this->session->setFoo('a-value');
 
         $this->backend->expects($this->once())
                       ->method('write')
                       ->with(array('foo' => 'a-value'));
-           
+
         $this->session->commit();
     }
 
@@ -408,13 +408,13 @@ public function testDestroyThrowsExceptionWhenSessionIsNotStarted()
     public function testDestroyCallsDestroyInBackend()
     {
         $this->session->configure($this->sessionName, $this->sessionDomain);
-        $this->session->start(); 
-        
-        $this->session->setFoo('a-value');    
+        $this->session->start();
+
+        $this->session->setFoo('a-value');
 
         $this->backend->expects($this->once())
                       ->method('destroy');
-           
+
         $this->session->destroy();
     }
 }
diff --git a/tests/PhpSessionBackendTest.php b/tests/PhpSessionBackendTest.php
index 5aa7dd0..2842a3f 100644
--- a/tests/PhpSessionBackendTest.php
+++ b/tests/PhpSessionBackendTest.php
@@ -55,7 +55,7 @@ class PhpSessionBackendTest extends PHPUnit_Framework_TestCase
      * @var spriebsch\session\SessionBackendInterface
      */
     protected $backend;
-    
+
     protected $sessionName = 'a-session-name';
 
     /**
@@ -92,7 +92,7 @@ protected function tearDown()
     public function testStartSessionSetsSessionName()
     {
         $this->backend->startSession($this->sessionName, 300, '/', '.example.com');
-        
+
         $this->assertEquals($this->sessionName, session_name());
     }
 
@@ -103,7 +103,7 @@ public function testStartSessionStartsASession()
     {
         $this->backend->startSession($this->sessionName, 300, '/', '.example.com');
 
-        $this->assertTrue(isset($_SESSION));        
+        $this->assertTrue(isset($_SESSION));
         $this->assertNotEmpty(session_id());
     }
 
@@ -115,7 +115,7 @@ public function testStartSessionSetsCookie()
         if (!in_array('xdebug', get_loaded_extensions())) {
             $this->markTestSkipped('xdebug not available');
         }
-    
+
         $this->backend->startSession($this->sessionName, 300, '/', '.example.com');
 
         $headers = xdebug_get_headers();
@@ -130,7 +130,7 @@ public function testStartSessionSetsCookie()
     public function testGetSessionIdReturnsSessionId()
     {
         $this->backend->startSession($this->sessionName, 300, '/', '.example.com');
-        
+
         $this->assertEquals(session_id(), $this->backend->getSessionId());
     }
 
@@ -142,7 +142,7 @@ public function testRegenerateIdChangesSessionId()
         $this->backend->startSession($this->sessionName, 300, '/', '.example.com');
         $id = $this->backend->getSessionId();
         $this->backend->regenerateSessionId();
-        
+
         $this->assertNotEquals(session_id(), $id);
     }
 
@@ -156,7 +156,7 @@ public function testReadReadsFromSessionSuperglobal()
 
         $this->assertEquals(array('foo' => 'a-foo'), $this->backend->read());
     }
-    
+
     /**
      * @covers spriebsch\session\PhpSessionBackend::write
      */
@@ -166,7 +166,7 @@ public function testWriteWritesToSessionSuperglobal()
         $this->backend->write(array('foo' => 'another-foo'));
 
         $this->assertEquals(array('foo' => 'another-foo'), $_SESSION);
-    }    
+    }
 
     /**
      * @covers spriebsch\session\PhpSessionBackend::destroy
@@ -177,7 +177,7 @@ public function testDestroyDestroysSession()
         $this->backend->destroy();
 
         $this->assertEmpty(session_id());
-    }    
+    }
 
     /**
      * @covers spriebsch\session\PhpSessionBackend::destroy
@@ -188,7 +188,7 @@ public function testDestroyUnsetsSessionSuperglobal()
         $this->backend->destroy();
 
         $this->assertFalse(isset($_SESSION));
-    }    
+    }
 
     /**
      * @covers spriebsch\session\PhpSessionBackend::destroy
@@ -198,7 +198,7 @@ public function testDestroySetsCookie()
         if (!in_array('xdebug', get_loaded_extensions())) {
             $this->markTestSkipped('xdebug not available');
         }
-    
+
         $this->backend->startSession($this->sessionName, 300, '/', '.example.com');
         $this->backend->destroy();