I believe that it's not an HTTPOnly Cookie (which is a problem because of XSS), and that it gets set in JS just before the request.

The idea is that due to the Same Origin Policy, other sites will not be able to set the Cookie for your domain.