Update to httpOnly in session