thoughtbot/clearance — pull request #306 by codesoda (2013-05-21 06:27:07+00:00)
Title: Added ability to set remember cookie as HttpOnly for added security

Cookies should be marked as HttpOnly for added security, otherwise persisted XSS could expose the cookie to a 3rd party. SSL is definitely a deterrent, but wouldn't solve this.