Set HttpOnly flag on session cookies to reduce XSS vulnerability