httpOnly should default to true here too.