Adding http only + secured cookie