add request and session httponly