Fix cookie is now always HTTPOnly...