Make cookie always http_only, and possibly secure.