Default cookies to http only
Default cookies to http only

Closes #455

By default cookies are signed and encrypted (and therefore useless) to
JavaScript. So we may as well set them to HTTP only for additional
security.

luckyframework/cli,luckyframework/cli,luckyframework/cli