Set httponly false on cookie