That is true, but I'm one of those guys who believe HTTP-only should die. Even without going as far as that, I believe that as soon as you have to manage some

That is true, but I'm one of those guys who believe HTTP-only should die. Even without going as far as that, I believe that as soon as you have to manage some kind of session you're going to have private data flying around, and that should be protected in TLS.