add httponly check