httponly and secure flag in httponly-filter-hook