Now session cookie is a httpOnly cookie