I cannot find any documentation on the internet on how to do this. I think maybe it can send some kind of custom HTTP header response, but it seems to be lame if there is a more canonical way.
theresponse.set_cookie(..., httponly=True, ...)