Fixes #3640: All cookies are not httpOnly by default in order to increase overall security