symfony session cookie should be httpOnly
update cgxp