adding secure httponly to session