fix(Session): Revert to non-blocking sessions (refs #4825)

Commit 3e47c82708155949b5059909cebd375eb53f19f0 introduced a regression
that blocked concurrent requests with same session id.

This reverts to the original non-blocking behaviour.
fix(HTTP): Send 403 Forbidden response in exitForbidden() (refs #4840)
fix(indent): Fix indentation in Class.Action.php (refs #4840)
feat(security): Set httpOnly on cookies (refs #4847)

Setting httpOnly to HTTP's cookies prevents JS code from reading (or
writing) the document.cookie, thus preventing some XSSes from stealing
session's cookie.
fix(offline): Clear referer reference after save waiting doc (refs #4845)
Merge pull request #1197 from Eric-Brison/3.2-I4845

fix(offline): Clear referer reference after save waiting doc (closes #4845)
fix(pack): Set session's name to "dcpsession" (refs #4848)
Merge pull request #1198 from eguaj/3.2-A4848

fix(pack): Set session's name to "dcpsession" (closes #4848)
Merge pull request #1196 from eguaj/3.2-A4847

feat(security): Set httpOnly on cookies (closes #4847)
Merge pull request #1195 from eguaj/3.2-A4840

fix(HTTP): Send 403 Forbidden response in exitForbidden() (closes #4840)
Merge pull request #1190 from eguaj/3.2-A4825

fix(Session): Revert to non-blocking sessions (closes #4825)
fix(security): Prevent XSS with warning messages (`addWarningMsg()`) (refs #4838)

Also:
- Prevent XSS with action done message (`addActionDone()`)
- Prevent XSS with error message (`exitError()`)
- Add `cleanhtmljs()` function in `freedom_util.php`
fix(security): Prevent XSS in viewcard.php (refs #4844)