Added httponly flag to cookie creation.