Set all cookies to be httpOnly by default. Previously all cookies where NOT httpOnly by default. The use case for setting these cookies to be secure is far more common than the other.