cookies are http only and have path set to /