Check that cookies are secure, httponly and scoped