renamed xss-cookie-theft problem to httponly.