Using httpOnly session cookie

Fixes #460