Don't mark banner cookies as HttpOnly