Session cookie named oidc is not HTTP only

[ErvinRacz]

Name: Nebraska backend
Action Needed: server.go implementation needs to be adjusted

Summary:
Session cookie named oidc is not HTTP only. It stores the refresh token. HTTP-only cookies allow us to store sensitive data, such as refresh tokens, in a way that cannot be accessed by JavaScript. This means that even if there are vulnerabilities in your code or third-party libraries, a hacker won't be able to retrieve the refresh token.