Added the http-only flag to the session cookie