Consider setting HttpOnly flag on session cookie

[strugee]

I believe we should be able to do this since the web UI acquires its own OAuth tokens and does stuff with that. Although I guess if it's compromised via an XSS attack the XSS code could maybe just steal the OAuth tokens? I think this depends on how we scope things out. I may end up filing a followup to audit that.