upgraded to servlet api 3.0.1 in order to have the httpOnly flag on cookies