set httponly to true to reduce identity theft through XSS attacks at session cookies