enable httpOnly and prevent client from reading cookie