httpOnly cookies

fixes #2664