Salesforce defaults to non http-only session cookies
twitter.com