Cookie set without HttpOnly flag

Have you tried adding

Header always edit Set-Cookie (.*) "$1; HttpOnly"
Header always edit Set-Cookie (.*) "$1; Secure"

to your .htaccess?

Found this on StackOverflow