Fixed a typo in the test suite that was causing some spurious failures with pypy.
Fixed #15808 -- Added optional HttpOnly flag to the CSRF Cookie.

Thanks Samuel Lavitt for the report and Sascha Peilicke for the patch.