fixed httpOnly & secure