add HttpOnly to session cookie