Adding cookie security flags (secure and http-only)