Go : Cookie: not HttpOnly