anchor.diff:            <div class="accordion-body collapse" id="collapseHttpOnlyFour" style="height: 0px;">
               <div class="accordion-inner">
           <p class="desc">
  -         INSERT DESC
  +         Can JavaScript interact with my session cookie?
           </p>
                </div>
             </div>
  
positive.code:           </div>
            <div class="accordion-body collapse" id="collapseHttpOnlyThree" style="height: 0px;">
              <div class="accordion-inner">
                <p><b>Lack of Password Complexity - SOLUTION</b></p>
          	  	INSERT SOLUTION
              </div>
            </div>
          </div>
  
negative.code:           <div class="accordion-body collapse" id="collapseHttpOnlyTwo" style="height: 0px;">
              <div class="accordion-inner">
  				<p class="desc">
  					By default, Ruby on Rails protects its' cookies with the HttpOnly flag. However, it is possible to disable this security protection and is not recommended. You can disable this protection using the flag highlighted below. This is an insecure and unnecessary change.
  				</p>	
         			<pre class="ruby">
  Railsgoat::Application.config.session_store :cookie_store, key: '_railsgoat_session', <span style="background:yellow">httponly: false</span>
  