removing httpOnly from cookies