What security mechanism prevents web browsers from disclosing sensitive cookies to third-party scripts by restricting access only to HTTP requests?