Always set httponly attribute on cookies