Changed back to HTTP-only cookies