Update README.md to document isHttpOnly option

Option found from here.
https://github.com/spumko/hapi/blob/master/docs/Reference.md#serverstatename-options

I confirmed with OWASP ZAP that this properly sets HttpOnly.
https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project

You might want to consider setting isHttpOnly to _true_ by default.