Protected by an encrypted, HTTP-only session.