title: HttpOnly / secure cookies with Play Framework and Google App Engine
body: <p>We're developing an application using Play! 1.2.5 and deploying to Google App Engine.
  In the application.conf I have set the session cookie to be httpOnly and secure:</p>
  
  <pre><code>application.session.httpOnly=true
  application.session.secure=true
  </code></pre>
  
  <p>When I fire a request locally, I can see the headers being set correctly:</p>
  
  <pre><code>Set-Cookie: PLAY_SESSION=something;Expires=Mon, 10-Dec-2012 14:51:56 GMT;Path=/;Secure;HTTPOnly
  </code></pre>
  
  <p>When I deploy to Google App Engine, I do not see any Secure or HTTPOnly flag on the cookies being set. How come?</p>
  
  <p>I can't find similar problems online. Closest thing I read was GAE not supporting response.setHttpOnly (or something similar) but from the Play! source code I can see a simple Cookie being created with a httpOnly value being set to a boolean value and written to the reponse. Not sure why GAE would not accept this.</p>
  
  <p>Thanks!</p>