Access and refresh tokens are stored in secure HttpOnly cookies.