Respect HttpOnly setting for FLASH and ERRORS cookies

This is for additional security against XSS attacks