closes #241 by adding HttpOnly cookie to true in web.xml