set httponly to remember_me's cookie