[herpderperator]

Great, so now we have the HttpOnly flag for cookies which differs from the Secure flag for cookies, while the Secure in the Sec headers has the same meaning as HttpOnly.

[billyhoffman]

And we have SameSite in Cookies, and Allow-Origin in headers!