Fix *** cookie to be client-accessible in logout endpoint - Changed setHttpOnly from true to false - *** should be client-accessible across all sites