Update cookie.php

Set HttpOnly flag to the cookies to help preventing XSS attacks targeting the cookies holding the clients session token.