Enforce the 'HTTPOnly' flag