Docs

Author: binaryk

README.md

@@ -143,7 +143,8 @@ Please see [CONTRIBUTING](CONTRIBUTING.md) for details.
 ### Security
 
 Since the Session Key and X-CSRF-TOKEN could be read by the JavaScript code, that means it's less secure than a usual
-http-only Cookie. Think of this as of the Bearer token. The security impact is exactly the same.
+http-only Cookie. But since we have different domains for the API and WEB, we don't have a way to setup a cookie. 
+You can think of this as of the Bearer token. The security impact is exactly the same.
 
 If you discover any security related issues, please email [email protected] instead of using the issue tracker.