adding httpOnly option

It should cover the HttpOnly cookie's option:
https://www.owasp.org/index.php/HttpOnly