Fix typo to enable secure sessions.  Enable httponly flag on cookies.