OF-902: Use HttpOnly for JSESSIONID

src/web/WEB-INF/web.xml

@@ -8,6 +8,13 @@
 
     <display-name>Openfire</display-name>
 
+    <!--  OF-902 use HttpOnly for session cookie -->
+    <session-config>
+	 <cookie-config>
+	  <http-only>true</http-only>
+	 </cookie-config>
+	</session-config>
+
     <!-- prevent URL rewritting with jsessionid included, OF-669 -->
     <context-param>
         <param-name>org.eclipse.jetty.servlet.SessionIdPathParameterName</param-name>