[http] use http-only cookies