Cannot set the httpOnly property on cookies

[paul.lemon]

We need to be able to set the httpOnly property on cookies created. C
This is a security requirement for our web application
http://www.owasp.org/index.php/HttpOnly explains this requirement.

The play cookie object (play.mvc.Http.Cookie) does not have any
property for httpOnly and also looking at the code in
play.mvc.HttpHandler there isnt any code related to the httpOnly
property.

Play framework should expose a boolean propery on play.mvc.Http.Cookie to allow this to be site.

I believe httpOnly should be set by default as this is a common secruity issue for all web sites.