wininet: Don't allow overriding httponly cookies with non-httponly ones.