a web developer wants to protect their new web application from a man-in-the-middle attack. which of the following controls would best prevent an attacker from stealing tokens stored in cookies?