make session cookie http only by default.