anchor.diff:            </div>
             <div class="accordion-body in collapse" id="collapseHttpOnlyOne" style="height: auto;">
               <div class="accordion-inner">
  -        		INSERT DESC
  +        		The HttpOnly flag prevents access to the document.cookie attribute of the DOM via JavaScript. Helpful for limiting the impact of Cross-Site Scripting as it relates to session theft.
               </div>
             </div>
           </div>
  
positive.code:           <div class="accordion-body collapse" id="collapseHttpOnlyTwo" style="height: 0px;">
              <div class="accordion-inner">
  				<p class="desc">
  					By default, Ruby on Rails protects it's cookies with the HttpOnly flag. However, it is possible to disable this security protection and is not recommended. You can disable this protection using the flag highlighted below. This is an insecure and unnecessary change.
  				</p>	
         			<pre class="ruby">
  Railsgoat::Application.config.session_store :cookie_store, key: '_railsgoat_session', <span style="background:yellow">httponly: false</span>
  
negative.code:           <div class="accordion-body collapse" id="collapseHttpOnlyFour" style="height: 0px;">
              <div class="accordion-inner">
          <p class="desc">
           Can JavaScript interact with my session cookie?
          </p>
               </div>
            </div>
  