all cookies should be able to set secure and httponly