add script for checking httponly cookies