Ruby : Cookie: not HttpOnly