Add HttpOnly support to cookie auth

Closes #807