determines if the browser should allow the cookie to be accessed by client-side javascript. The default is true, which means the cookie will only be passed to http requests and is not made available to script on the page.
is currently ignored. Use ExpireTimeSpan to control lifetime of cookie authentication.