Cookies are now set as HTTPONLY, say goodbye to most xss attacks

This is what happens when a xss attack takes place with cookies set as HTTPONLY :)

![xss](https://cloud.githubusercontent.com/assets/8127545/4871868/ec98d740-61ca-11e4-8b8d-1ebb6873b929.png)