httponly cookie attribute

granting my own wish #68

I'm piggy backing on the test suite for header here but we probably need a cookie specific test suite.