modify httponly cookie setting