Set HttpOnly on cookies. Thanks @Simon_Gee.