docs: protected void setSecureCookies() {
  
      SessionManager sessionManager = webapp.getSessionHandler().getSessionManager();
      if (!(sessionManager instanceof AbstractSessionManager)) {
        throw new RuntimeException("Cannot set secure cookies on session manager.");
      }
  
      AbstractSessionManager abstractSessionManager = (AbstractSessionManager) sessionManager;
  
      abstractSessionManager.getSessionCookieConfig().setSecure(isSecureCookies());
      abstractSessionManager.setHttpOnly(true);
    }