back to httponly. This not work. Hmm. That should be SSL. Definitely