[labourcurious]

The author glosses over this but what they mean is that you can set the HttpOnly flag on cookies to prevent them from being accessed via JavaScript.

[akarambir]

But is it still sent automatically on ajax requests by browsers?

[SahAssar]

Yes.