I found an XSS on and am able to steal httpOnly cookies now what?