The seeming luxury of having multiple words to choose from is not sufficient to offset the lingering fear that no matter which word you pick it will be the wrong one, causing people to silently laugh at you and judge both you and your grammar school teachers

So if I just forward the cookie header (which contains the access-token), wouldn't that be just what I am not supposed to do. I mean what's the point of using 'HttpOnly' flag if I return the token to the client-side js on every request.