use HTTPOnly by default for the cookie