use httponly flag for all cookies