restapi: Add HttpOnly flag to session cookie

The CSRF protection mechanism has been implemented in a way that doesn't
require reading the value of this cookie, so the flag can be enabled
now.

Change-Id: Id0a315fda675ec2c606589f9028d7284d68496d5
Signed-off-by: Juan Hernandez <juan.hernandez@redhat.com>