Http.Entity: session-cookies are not httponly anymore