Add CSRF_COOKIE_HTTPONLY config value

Follow-up of https://github.com/django/django/pull/114

Copied my last comment:

Maybe it makes sense to keep the config value and set it to False by default, otherwise the current CSRF+Ajax recipe in the official Django documentation won't work (https://docs.djangoproject.com/en/dev/ref/contrib/csrf/#ajax) because access to 'document.cookies' is restricted (obviously). Of course there are other ways to do it (like http://erlend.oftedal.no/blog/?blogid=118) but maybe this is worth discussing beforehand.