enable httponly for cookies by default; set _xsrf cookie as not httponly