API Cookies set via Cookie::set() are now HTTP only by default
Merge pull request #3505 from halkyon/cookie_httponly

Cookies set via Cookie::set() are now HTTP only by default