Ok, you've got a point here.
But secure & httponly should have `is_bool()` checks.