add HttpOnly flag to cookies by default; can be disabled by config