Make auth JWTs http-only cookies (by default)

Correct me if i am mistaken but the default way of sending cookies to the client is using local storage. If i want to setup http-only cookies, i have to add another webserver as a middleware that would take the Supabase response and replace the header being sent with an http-only cookie. This is a major concern for me. I tend to use JWT tokens as data carriers for ABAC authorization on my services (the signing key is first verified then a service-scoped policy uses the JWT claims to handle authZ locally and without making a call to an IAM server or to a gateway) and i don't want this data to be exposed to the client. Is there a way to send http-only cookies directly from Supabase? If not, could you please add that feature to the app as soon as possible? I could add a middleware webserver but that would kill the purpose of using Supabase for authN. When it comes to session security, providing at least an option to configure http-only tokens which cannot be access from clien…