[#1941] Warn against setting httponly to False