always set httponly (there is no good reason not to)
simplify httpsonly and expire flags