always set httponly (there is no good reason not to); simplify httponly and expire flags