feat(security): Set httpOnly on cookies (closes #4865)