deny XSS atac add httpOnly: true