rollback: set httponly default is false.