[gigaftp]

In the context of a compliant web browser you can set a cookie as http only as to disallow access it via Js.