LPS-19107

Tomas, can you check this for me.

The idea is to always set HttpOnly. The portal property is for situations where you have JavaScript that also needs to access the cookie. I didn't want to add a httpOnly parameter to #addCookie because I want to use httpOnly be default.

This code is only for 6.2. I spent 2 days on trying to get the code to work on 6.1.x and it's really difficult because 6.1 doesn't support Java 6. So I had to use the Set-Cookie header which didn't play nicely in 6.1.x. So I'm giving up on 6.1.x.