Set SSP cookies to secure and httponly by default.