HttpOnly cookies

- Enabled HttpOnly attribute for all cookies.