add cookie.httponly bool option.