Add HttpOnly configuration option