Set session cookie as HTTP Only. Closes #1209.