change session httponly flag to false