Set session.cookie_httponly and session.use_only_cookies to always true