Don't allow access to the cookie from client javascript