cherry pick commit for #536 - fixes httpOnly cookie bug