only set secure and httponly if set to True