Fix Cookielist restrictions

previous would only display "HTTP Only" if the cookie was both
"HTTPOnly" and "Secure"