Use HttpOnly flag for session cookie

[cnsgithub]

Session cookies should be HttpOnly, see https://www.owasp.org/index.php/HttpOnly.

Otherwise, XSS vulnerabilities can lead to session hijacking, see primefaces/primefaces#3623 for example.

Just imagine, store.primefaces.org wasn't isolated from showcase and you previously were logged in as superuser...

[tandraschko]

How can we do that? Its up to jetty

[melloware]

You can do it in the web.xml

	<session-config>
		<session-timeout>60</session-timeout>
		<cookie-config>
			<http-only>true</http-only>
		</cookie-config>
		<tracking-mode>COOKIE</tracking-mode>
	</session-config>

[cnsgithub]

PR: #80