Use the httponly-flag on our cookie.

  This will protect us a little if we have an XSS attack on our
 domain.