[security-dev] RESTEasy and HTTPOnly Cookies