Made the cookie token HTTP only.