http only cookies, fixes #19