I assume that tick is for httpOnly flag right?