val httpOnly: Boolean
only transfer cookie over HTTP, no access from JavaScript
httpOnly - only transfer cookie over HTTP, no access from JavaScript
httpOnly