Make the default HTTP server configuration more secure

sdk/lib/io/http_headers.dart

Index: sdk/lib/io/http_headers.dart
diff --git a/sdk/lib/io/http_headers.dart b/sdk/lib/io/http_headers.dart
index f621fff07fa1fc8e4246393737fc110480e49b4d..4609ac49df3c7668ef75080c3db2760a210516a5 100644
--- a/sdk/lib/io/http_headers.dart
+++ b/sdk/lib/io/http_headers.dart
@@ -20,11 +20,21 @@ class _HttpHeaders implements HttpHeaders {
   final int _defaultPortForScheme;
 
   _HttpHeaders(this.protocolVersion,
-               {int defaultPortForScheme: HttpClient.DEFAULT_HTTP_PORT})
+               {int defaultPortForScheme: HttpClient.DEFAULT_HTTP_PORT,
+                _HttpHeaders initialHeaders})
       : _headers = new HashMap<String, List<String>>(),
         _defaultPortForScheme = defaultPortForScheme {
+    if (initialHeaders != null) {
+      initialHeaders._headers.forEach((name, value) => _headers[name] = value);
+      _contentLength = initialHeaders._contentLength;
+      _persistentConnection = initialHeaders._persistentConnection;
+      _chunkedTransferEncoding = initialHeaders._chunkedTransferEncoding;
+      _host = initialHeaders._host;
+      _port = initialHeaders._port;
+    }
     if (protocolVersion == "1.0") {
       _persistentConnection = false;
+      _chunkedTransferEncoding = false;
     }
   }
 
@@ -252,6 +262,16 @@ class _HttpHeaders implements HttpHeaders {
     _set(HttpHeaders.CONTENT_TYPE, contentType.toString());
   }
 
+  void clear() {
+    _checkMutable();
+    _headers.clear();
+    _contentLength = -1;
+    _persistentConnection = true;
+    _chunkedTransferEncoding = false;
+    _host = null;
+    _port = null;
+  }
+
   // [name] must be a lower-case version of the name.
   void _add(String name, value) {
     assert(name == _validateField(name));
@@ -801,6 +821,8 @@ class _Cookie implements Cookie {
   bool secure = false;
 
   _Cookie([this.name, this.value]) {
+    // Default value of httponly is true.
+    httpOnly = true;
     _validate();
   }