[1.6.x] Fixed #23149 -- Clarified note on HTTPOnly in cookie-based session docs

Backport of e26366da44bb343e7a95d01ff0dd18b8026c2802 from master.