To help mitigate XSS attacks against the user's session cookie, set the session cookie
to be HttpOnly. In browsers that support the HttpOnly feature (such as more recent
versions of Internet Explorer and Firefox), this attribute can prevent the user's session
cookie from being accessible to malicious client-side scripts that use document.cookie.