security: make FLASH cookie respect the HttpOnly config parameter
security: make ERRORS cookie respect the HttpOnly config parameter
Merge branch 'cookies-httponly' into 1.3.x-codeborne