What should be included in a HTTP response header to ensure that a cookie cannot be accessed through client side script $($in JavaScript, for example$)?$

session ID

encryption ID

timeout flag

httponly flag