Document why we don't set httponly on csrf_token
Merge pull request #3031 from gratipay/document-httponly

Document why we don't set httponly on csrf_token