Security enhancement: set auth cookie as HttpOnly
Security enhancement: set auth cookie as HttpOnly

It also might be interesting to set the "secure" bit for https-only web
interfaces.

laurentb/assnet,laurentb/assnet