Do not use setHttpOnly() for now.