Sensitive cookies without the HttpOnly response header set — CodeQL query help documentation