Cookies are now set as httponly and can not be read by javascript

please review