Making cookies httpOnly