Set HTTPOnly on the session cookie