add HttpOnly and Secure