set HTTPOnly in cookie

hmm,I see

 

1:we set the httponly firstly

 

2:then mainpulate the secure flag,

 

 

step 1 doesn't conflict with step 2