prevent XSS on supporting browsers
set cookies as HttpOnly