Allow changing httponly and secure cookie flags using runtime configuration