I think session's cookie httponly should default to true