Cookie defaults to httponly, and automatically turns on secure flag if running over https