docs - clarify :secure and :http-only in wrap-cookies