Fixed #23149 -- Clarified note on HTTPOnly in cookie-based session docs