Cookies are now set as httponly and can not be read by javascript

please review
@NullArgument Why did you remove this?