Fixes for update monitor polling

  * Don't use httponly for session cookies.  We need access to sessions from AJAX.

  * Don't apply CSRF protection to the "poll" method, since it zaps the session
    when it fails.