Don't recommend setting SESSION_COOKIE_HTTPONLY

This setting is already defaults to true, so there is no need to
recommend that people set this option to prevent cross site scripting.

Closes-Bug: 1333407
Change-Id: If5c8f3cba31f6e613ec17af81cff8d15cd2f8f19
Merge "Don't recommend setting SESSION_COOKIE_HTTPONLY"