Need to go back and change the HttpOnly library from the hand rolled one to the atlassian-security one.

See https://atlaseye.atlassian.com/cru/CR-ATL-251#CFR-140658 for more details.

Basically I wrote my own HttpOnly cookie code and we know have a standard atlassian-security implementation. We should use the new one.