Set HttpOnly to true to protect cookies

This is a re-submit of #408, which rightly suggests that all cookies should be set as HttpOnly by default.
Merge pull request #413 from gixug/patch-1

Set HttpOnly to true to protect cookies