/csrf-token-cookies-dont-need-httponly/
https://joshkaramuth.com/blog/csrf-token-cookies-dont-need-httponly