Set HttpOnly to true to protect cookies

This is a re-submit of #408, which rightly suggests that all cookies should be set as HttpOnly by default.