added cookie HttpOnly support