turns token cookie to httponly