correct Cookie class

httpOnly is not an antonym for Secure