[fix bug 1069991] Add HTTPOnly flag to CSRF Cookie.
[fix bug 1069994] Add secure flag to CSRF Cookie.