Merge branch 'hotfix/register' into hotfix/security-2

@@ -84,6 +84,7 @@ class Auth {
                     `${data.profile_name}::${encryptionUid}::${data.vip_info && data.vip_info.title}::${saltedToken}`;
 
                 res.cookie('_UID', uidCookie, {
+                    httpOnly: true,
                     domain: 'yohobuy.com',
                     expires: new Date(Date.now() + 2592000000) // 有效期一年
                 });
@@ -92,6 +93,7 @@ class Auth {
             req.session.TOKEN = publicToken;
             req.session.LOGIN_UID = uid;
             res.cookie('_TOKEN', publicToken, {
+                httpOnly: true,
                 domain: 'yohobuy.com',
                 expires: new Date(Date.now() + 2592000000) // 有效期一年
             });