FormsAuthentication is now httpOnly