make JSESSIONID cookie httpOnly