Session cookies are not marked as HttpOnly

Reported by the dutch security audit.

Session cookies (user, password, rememberme, validation, jsessionid) should have an additional HttpOnly flag. Setting this flag prevents accessing those cookies from JavaScript, which prevents one of the most common XSS attacks (stealing cookies aka. session hijacking).

This flag is supported by most browsers (IE6+, FF, Chrome), other browsers ignore it.

A lot of useful information can be found here: http://www.owasp.org/index.php/HttpOnly