PL or SQL : Cookie: not HttpOnly