Now ensuring that session cookie is HTTP-only