APP-116 ensure session cookies are HttpOnly