Setting session cookie to HTTP only.