HUE-1639 [core] HTTPOnly on session cookie