API Cookies set via Cookie::set() are now HTTP only by default