improve session cookie value: httponly and expire