reyez/ninja — pull request #74 by roughy (2013-02-07 10:55:01+00:00)
Title: Feature/session cookie http only

HttpOnly flag at the session cookie.
On a supported browser, an HttpOnly session cookie will be used only when transmitting HTTP (or HTTPS) requests, thus restricting access from other, non-HTTP APIs (such as JavaScript). This restriction mitigates but does not eliminate the threat of session cookie theft via cross-site scripting (XSS).