adding httponly and secure flags