Fixed security hole with session cookie

Session cookie will always be set with the HTTP only flag from now on.