complement the User Guide regarding HttpOnly cookies