make session-cookie HttpOnly

closes #7041

Changelog.md

@@ -3,6 +3,7 @@
 ## Refactor
 * Indicate proper way to report bugs in the sidebar [#7039](https://github.com/diaspora/diaspora/pull/7039)
 * Remove text color from notification mails and fix sender avatar [#7054](https://github.com/diaspora/diaspora/pull/7054)
+* Make the session cookies HttpOnly again [#7041](https://github.com/diaspora/diaspora/pull/7041)
 
 ## Bug fixes
 

config/initializers/session_store.rb

 # Be sure to restart your server when you modify this file.
 
-Diaspora::Application.config.session_store :cookie_store, key: '_diaspora_session', httponly: false
+Diaspora::Application.config.session_store :cookie_store, key: "_diaspora_session", httponly: true