Fixed: Cookies do not set HttpOnly attribute (bug#9926).