httpOnly needs to be false for js to access the cookie