shouldNotBeHttpOnly