[webapi] Fix security issue form zap scan

- Set "HttpOnly" to all cookies
- Turn off AUTOCOMPLETE attribute in form input element
  containing password by using autocomplete="off"