interesting find. I'm not sure if this is the problem, as the first issue listed is a referral from http to https, and the second and third ones are around the session cookie (which DNN doesn't use). However, I'd planned on altering the chunk of code that add's the HttpOnly attribute to all cookies, so that it only protects cookies the DNN framework generates. My preference would be to not do this, as it provides an additional layer of XSS protection, but there was a request to change this, as some people generate client cookies in server code, and this could cause their functions to fail. This change will be checked in for the next release hopefully.

Cathal