fix(security): set the HttpOnly cookie attribute (#22)

fix(security): set the HttpOnly cookie attribute (#22) #49