Clarify the meaning of what the missing httpOnly cookie attribute means.