Config files : Cookie: not HttpOnly