set httpOnly and secure on cookies to fix spotbugs issue
@@ -4560,6 +4560,8 @@ public class Jenkins extends AbstractCIBase implements DirectlyModifiableTopLeve
throw new ServletException();
Cookie cookie = new Cookie("iconSize", Functions.validateIconSize(qs));
cookie.setMaxAge(/* ~4 mo. */9999999); // #762
+ cookie.setSecure(true);
+ cookie.setHttpOnly(true);
rsp.addCookie(cookie);
String ref = req.getHeader("Referer");
if(ref==null) ref=".";
