Allow HttpOnly Flag for authentication cookies

As far as I understand right now it's possible to use HttpOnly flag for state, but not for cookie auth.

See: https://www.owasp.org/index.php/HttpOnly

Expected:

``` javascript
server.auth('session', {
    scheme: 'cookie',
    password: 'secret',
    cookie: 'sid-example',
    redirectTo: '/login',
    isHttpOnly: true
});
```
