set httponly flag to true in setcookie (minor security thing)