Proxy cookie spike app-shell
idle

document.cookie (should stay empty, cookie is HttpOnly):