changed cookie to not httponly so it can be used in js