Fixed #20972 -- Make messages cookie follow session cookie secure/httponly