6873543: CookieManager doesn't enforce httpOnly

Adds check for httpOnly tag and clarifies javadoc

Reviewed-by: chegar