Setting the httpOnly flag on the session cookie.