Fixed code to have auth cookie as HttpOnly