feat(security): Set httpOnly on cookies (refs #4847)

Setting httpOnly to HTTP's cookies prevents JS code from reading (or
writing) the document.cookie, thus preventing some XSSes from stealing
session's cookie.
Merge pull request #1196 from eguaj/3.2-A4847

feat(security): Set httpOnly on cookies (closes #4847)