discourse/discourse — pull request #215 by tms (2013-02-21 03:18:36+00:00)
Title: Sign the auth token cookie and make it httpOnly

Since this seems to be a non-expiring value, eliminating the potential to make a lucky guess and protecting the cookie from XSS sniffing seems like the best call.