[soup] Prevent setting or editing httpOnly cookies from JavaScript