code: private Cookie _createFlashCookie(String name, String value, ExternalContext externalContext)
      {
          Cookie cookie = new Cookie(name, value);
  
          cookie.setMaxAge(-1);
          cookie.setPath(_getCookiePath(externalContext));
          cookie.setSecure(externalContext.isSecure());
          //cookie.setHttpOnly(true);
          if (ServletSpecifications.isServlet30Available())
          {
              _Servlet30Utils.setCookieHttpOnly(cookie, true);
          }
          return cookie;
      }
docs: Creates a Cookie with the given name and value.
  In addition, it will be configured with maxAge=-1, the current request path and secure value.
  
  @param name
  @param value
  @param externalContext
  @return