Revert "setcookie specify httponly"

This reverts commit 337afd123a84b1c53e5337a6c5e36bc47b2376f7.