MYFACES-3694 Add httpOnly to ExternalContext.addResponseCookie(...) (Thanks to Paul Nicolucci for provide this patch)