Zuora is asking to add 'httponly' flag to session cookies to improve site security.