move remember_me_httponly outside user block