Adding the flag <Context ... useHttpOnly="true"> in the tomcat configuration file (server.xml) has no effect. It seems terracotta ignores this flag. Without the TerracottaTomcat60xSessionValve it work as expected.
I believe the httpOnly option is supported for Tomcat 7 onwards in Terracotta , as this option was originally introduced with Tomcat 7. Can you try with Tomcat 7 and let us know if that works for you.