Use httponly session cookies.