XSS attacks.

Also note that the cookies should be http only and with the secure flag