[#1941] Docs and changelog for HttpOnly flag