Servlet 3.0 有 cookie.setHttpOnly(true); 多么人性化，

Servlet 2.5 是没有这个方法的要这个曲线救国：cookie.setPath("; HttpOnly;");

thanks to :
http://stackoverflow.com/questions/13147113/setting-an-httponly-cookie-with-javax-servlet-2-5

Java Servlet 2.5 设置 cookie httponly