Set remember cookie as HTTP only for security

Cookies should be marked as HttpOnly for added security, otherwise
persisted XSS could expose the cookie to a 3rd party. SSL is definitely
a deterrent, but wouldn't solve this.