What the HttpOnly flag does, what it stops (token theft via XSS), what it doesn't, and how to set it in Express and Next.js.