set http_only flag