Just a minor peeve, but I find it a little aggravating to have to call three separate session functions when it seems to me that a single one could work just as well:
session_start('name', 'lifetime', 'path', 'domain', 'secure', 'httponly');
Is there any good reason it couldn't work this way?