backend: set HttpOnly for all cookies

Change-Id: I25ae26677c99f94a5e6d7cfe39444811d13ec29c
Signed-off-by: Alon Bar-Lev <alonbl@redhat.com>