set cfid and cftoken cookies as httponly
Merge pull request #314 from igal-getrailo/jira-2773

set cfid and cftoken cookies as httponly