Experiment. What will be if cookie is not HTTP only. Will it be used in CORS?