restore httponly in session