Via Ilia, Scott MacVicar has provided a patch that adds support for HttpOnly to setcookie() and setrawcookie(). This has been possible with header() all along, but this patch (applied by Ilia) makes things much easier.

Andrew has more information about browser compatibility, and he links to a potential solution for (and further discussion about) Mozilla/Firefox's lack of support.