OPH-626: Set HttpOnly and path for session cookie.