added default healthcheck and set cookies to httpOnly by default