Enable httponly by default