docs - clarify :secure and :http-only in wrap-cookies

...or something along these lines.