enable http only cookies.