Enforce the "HTTPOnly" flag, if If the application doesn't need to access the cookie

This prevents the browser from reveal a session cookie, against XSS attacks and users from accidentally access a resource that exploits this flaw.