Cookies are http-only and secure on https