Cookie header names supported by default.
Used for a full user login auth.
Used for storing the CSRF token. Not HttpOnly so that frontend JS can read it.
HttpOnly
Use for a temporary "just signed up" auth.
Cookie header names supported by default.