default session cookie httpOnly to true