access to HTTP headers, including the Set-Cookie header in which the HttpOnly flag is
set.
Assume all input is malicious. Use an "accept known good" input validation strategy,
i.e., use a whitelist of acceptable inputs that strictly conform to specifications. Reject any