set httponly=False for csrf cookie as it needs to be accessed from javascript
Merge pull request #2491 from gittip/fix-csrf-cookie

Fix CSRF cookie
Merge branch 'master' into cancel-account