add en upstream patch to ensure HttpOnly cookie flag is properly set and avoid warning messages about Security cookie flag