It seems ServletExec is unable to use httponly cookies as it use Java Servlet API 2.5 . httponly is supported from Java Servlet API 3.0.
Has anyone found a workaround such that when the request hits affwebservices, the httponly attribute does not get dropped using ServletExec?