change autologin cookie httponly

change autologin cookie httponly