#shiny "#cross-site scripting" #httpOnly #cookie