configurable httponly flag in set cookie method