// the key is exchanged for an httpOnly cookie server-side.
// your browser never stores it.