[webapi] Fix security issue form zap scan

- Set "HttpOnly" to all cookies
- Turn off AUTOCOMPLETE attribute in form input element
  containing password by using autocomplete="off"
Merge pull request #297 from haoxli/haoxli/webapi/zap-security-4

[webapi] Fix security issue form zap scan