Secured with an encrypted, HTTP-only session.