make session cookie not httpOnly