Explicitly set 'http_only' to true