Add the HttpOnly flag to the session cookie

Enforce that the Balsa session cookie is not available from Javascript.