Add HttpOnly flag to cookies