XSRF-TOKEN cookie can be securely set as httpOnly in config

see: laravel#16191

src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php

@@ -136,7 +136,7 @@ protected function addCookieToResponse($request, $response)
         $response->headers->setCookie(
             new Cookie(
                 'XSRF-TOKEN', $request->session()->token(), Carbon::now()->getTimestamp() + 60 * $config['lifetime'],
-                $config['path'], $config['domain'], $config['secure'], false
+                $config['path'], $config['domain'], $config['secure'], $config['http_only']
             )
         );