[1.5.x] Fixed #20444 -- Cookie-based sessions does not include a remote code execution-warning

Backport of d5ce2ff5e4 from master