title: Unable to validate Antiforgery token when cookie is set to httponly
body: <p>When i set the value of httponly=true. AutoValidateAntiforgeryTokenAttribute doesnot validate the request and return 400 bad request</p>
  
  <pre><code>AntiforgeryTokenSet tokens = antiforgery.GetAndStoreTokens(context);
     context.Response.Cookies.Append("XSRF-TOKEN", tokens.RequestToken,
      new CookieOptions() { HttpOnly = true});
  </code></pre>
  
  <p>After doing this cookie become secure as shown below</p>
  
  <p><code>set-cookie: XSRF-TOKEN={{Cookie Value}}; path=/; samesite=lax; httponly</code></p>
  
  <p>But AutoValidateAntiforgeryTokenAttribute returns 400 bad request</p>
  
  <p><code>when changed the Value HttpOnly = true to HttpOnly = false</code></p>
  
  <p>It works perfectly fine. Is there is way to set antiforgerytoken cookie to httponly in asp core and angular 7. If it will not work can some body please guide me through about the reason behind it.</p>