Adding httponly option