Set secure and httponly properties on session cookie