[#1941] Tweak changelog for CORS and HttpOnly