#http-only #xss #webdev #security