Add http only cookie on server-side