Set the http only parameter for CSRF cookies to true