turn on httpOnly for security audit