Set httponly for cookies to enhance security

- A cookie without the HttpOnly flag means that the cookie can be accessed by JavaScript. If a malicious script can be run on this page then the cookie will be accessible and can be transmitted to another site. If this is a session cookie then session hijacking may be possible.