move remember_me_httponly to a better location