a rewriting rule that adds "HttpOnly" to any out going "Set-Cookie" headers

IIS7: rewrite cookies to be httponly

<?xml version="1.0" encoding="UTF-8"?>
<configuration>	    
<system.webServer>				
<!--
Rewrite any outgoing "Set-Cookie" headers to be "HttpOnly"
Requires the IIS7 URL Rewrite Module, available from: http://www.iis.net/download/urlrewrite
-->	
       <rewrite>
            <outboundRules>
                <rule name="Add HttpOnly" preCondition="No HttpOnly">
                    <match serverVariable="RESPONSE_Set_Cookie" pattern=".*" negate="false" />
                    <action type="Rewrite" value="{R:0}; HttpOnly" />
                    <conditions>
                    </conditions>
                </rule>
                <preConditions>
                    <preCondition name="No HttpOnly">
                        <add input="{RESPONSE_Set_Cookie}" pattern="." />
                        <add input="{RESPONSE_Set_Cookie}" pattern="; HttpOnly" negate="true" />
                    </preCondition>
                </preConditions>
            </outboundRules>
        </rewrite>
	</system.webServer>	
</configuration>