feat(security): Set httpOnly on cookies (closes #4847)