Don't strip out http-only cookies on https, http-only applies to javascript

As discussed on IRC, code + tests included