Cookies are now set as httponly and can not be read by javascript

please review
That's the only explanation. I'll close this pull request again :P