default httponly to true
update release notes