add -httponly to all calls to CGI::Cookie->new()