Session cookie should not be retrieved from js