diff --git a/pom.xml b/pom.xml
index a8c9f037..038c5709 100644
--- a/pom.xml
+++ b/pom.xml
@@ -44,8 +44,8 @@
   <dependencies>
     <dependency>
       <groupId>javax.servlet</groupId>
-      <artifactId>servlet-api</artifactId>
-      <version>2.5</version>
+      <artifactId>javax.servlet-api</artifactId>
+      <version>3.1.0</version>
       <scope>provided</scope>
     </dependency>
     <dependency>
diff --git a/src/main/java/com/samskivert/servlet/user/UserManager.java b/src/main/java/com/samskivert/servlet/user/UserManager.java
index 5536d5c7..ae15d67e 100644
--- a/src/main/java/com/samskivert/servlet/user/UserManager.java
+++ b/src/main/java/com/samskivert/servlet/user/UserManager.java
@@ -299,6 +299,7 @@ public class UserManager
         }
         acookie.setPath("/");
         acookie.setMaxAge((expires > 0) ? (expires*24*60*60) : -1);
+        acookie.setHttpOnly(true);
         if (USERMGR_DEBUG) {
             log.info("Setting cookie " + acookie + ".");
         }