Support the 'HttpOnly' flag when setting cookies

[reed]

The Twisted 'web' module doesn't support the addition of the 'HttpOnly' flag when setting a cookie.

 http://www.owasp.org/index.php/HTTPOnly

[reed]

Add support for HttpOnly flag in cookies

[reed]

While Python has supported the 'HttpOnly' flag in cookies for quite a while ( http://bugs.python.org/issue1638033), it doesn't look like there's a 'httponly' attribute, at least according to  http://docs.python.org/library/cookielib.html#cookie-objects. I will follow-up with that to see if that's true, and if so, get it fixed upstream.

New patch with a test coming up.

[reed]

Same as above but includes a test

[therve]

Thanks for your patch! There is one main problem:

1. Your test doesn't match your change. The test applies to the client, not server Request.addCookie.