Add httponly option.