Added checks for secure/httponly CSRF cookie.