Set HttpOnly for JSESSIONID cookie

When you tag a cookie with the HttpOnly flag, it tells the browser that this particular cookie should only be accessed by the server. Any attempt to access the cookie from client script is strictly forbidden.

Since we do not currently have any requirement to manipulate the jsessionid cookie from client side scripts, setting this flag will make openmrs more secure.

For more details, see https://www.owasp.org/index.php/HttpOnly