According to Mozilla best-practices (see https://observatory.mozilla.org
and https://infosec.mozilla.org/guidelines/web_security#cookies )
session cookies should be created with the HttpOnly flag. This prevents
XSS vulnerabilities.

This PHPSESSID cookie is still sent over ajax calls (it just prevents JS to
access it) so it does not break any usage

Fix #709

Fixes #161

Added local Joomla integration rather than relying on Joomla having the separate plugin installed. (But still support the plugin if it's there, as it gives a lot more flexibility)

Applies to Q2A ‘internal’ users (already exists for external users).
External user version updated to handle flags.

Replace old hcard microformat

Slightly hacky since answers/comments don’t have titles. Probably need
to switch to schema.org microdata instead.