Enable CASHttpOnly by default