Where does odoo set the tz cookie?  My security team flagged the cookie as a security finding as it is not marked for httponly or secure.  

For the session_id, I was able to set this in /odoo/odoo-server/odoo/http.py at about line 1409 by setting the session_id like:

set_cookie('session_id', httprequest.session.sid, max_age=1 * 24 * 60 * 60, secure=True, httponly=True)

I am looking for similar code within odoo and am unable to find it.  The closest I've come is in the same file around line 828 where cookies iterated through and set, but 'tz' is not one of them.

res_partner in the base addons folder looks promising, but it's not quite it either.  Maybe I'm overlooking something.