Make locale and timezone cookies HttpOnly

The cookies for local and timezone are managed and used by the LoginPanel, there is no functional need for them to be read by javascript, so we should mark them HttpOnly.

The usage-statistics script still tries to read the locale cookie in case it is not provided with the 'start-usage-statistics' event, which is only true for CMS < 11.2.

I did not find any other pieces of javascript that rely on these cookies. And if there is still a need to know these values from javascript, there is a much simpler way with these two global vars:

window.Hippo.Session.locale
window.Hippo.Session.timezone