Add httponly to session cookie.