Mantis #271 : add HttpOnly attribute