[1.6.x] Added a warning regarding session security and subdomains.

Backport of a3372f67cb from master