issue-1: support cookie httpOnly attribute (fixes #1)