Add CSRF_COOKIE_HTTPONLY config value

Follow-up of #114 and more recently #150, rebased on current master. Hopefully it's not lying around for another 8 months :-) So I copied my last comment:

Maybe it makes sense to keep the config value and set it to False by default, otherwise the current CSRF+Ajax recipe in the official Django documentation won't work (https://docs.djangoproject.com/en/dev/ref/contrib/csrf/#ajax) because access to 'document.cookies' is restricted (obviously). Of course there are other ways to do it (like http://erlend.oftedal.no/blog/?blogid=118) but maybe this is worth discussing beforehand.