Set the HttpOnly flag on cookies