feat(security): Set httpOnly on cookies (refs #4865)

Setting httpOnly to HTTP's cookies prevents JS code from reading (or
writing) the document.cookie, thus preventing some XSSes from stealing
session's cookie.
Merge pull request #1240 from eguaj/3.3-A4865

feat(security): Set httpOnly on cookies (closes #4865)