Turn HTTPOnly cookies back on.  Turning them off was me being misguided, since HTTPOnly doesn't stop the cookie being sent through with AJAX requests.