Use HTTPOnly cookies when possible. #73