backend: set HttpOnly for all cookies

- Re-introduce http only patch after session is no longer read
  from cookies.

Change-Id: Ia82d2f594e9f923e03dffc55ea0bcf5d4802f738
Signed-off-by: Alon Bar-Lev <alonbl@redhat.com>