Added ability to set remember cookie as HttpOnly for added security

Cookies should be marked as HttpOnly for added security, otherwise persisted XSS could expose the cookie to a 3rd party.  SSL is definitely a deterrent, but wouldn't solve this.