- Cookie creation is now HttpOnly = true to help prevent client-side reading of the cookies.