added HttpOnly option to http resp header