"AlpacaHack - OpenBio": CSP + HTTPOnly = Invulnerable?

This challenge featured CSP bypass using jsdelivr, and small knowledge about Cookie sorting done by the browser.