HttpOnly X-Cache: bypass