Cookies are now set as HTTPONLY

please review