adding httpOnly option