Ensure cookies have httponly and secure flags set
database
core forms