Update servlet-api to 3.0 and add HTTP Only config