set httponly=False for csrf cookie as it needs to be accessed from javascript
Merge pull request #2491 from gittip/fix-csrf-cookie

Fix CSRF cookie