Adds handling of HttpOnly when converting NewCookie to string suitable for HTTP Set-Cookie header

Currently, the httpOnly boolean in NewCookie is not honoured when creating the string representation for the cookie (as far as I can tell, toString() is used when setting the Set-Cookie HTTP header). The effect is that it is not possible to set cookies to HttpOnly in Jersey. This diff changes that.