various tweaks and cleanups

decided to do a PR against your PR so you can see what i am doing.
reading up on this again it simply makes no sense whatsoever to have a httpOnly cookie that is intended to be used in javascript. removed this option.