Documented session.http_only (#4743)

Credit to @ayumi-cloud

config/session.php

@@ -137,6 +137,19 @@ return [
 
     'domain' => null,
 
+    /*
+    |--------------------------------------------------------------------------
+    | HTTP Access Only
+    |--------------------------------------------------------------------------
+    |
+    | Setting this value to true will prevent JavaScript from accessing the
+    | value of the cookie and the cookie will only be accessible through
+    | the HTTP protocol. You are free to modify this option if needed.
+    |
+    */
+    
+    'http_only' => true,
+
     /*
     |--------------------------------------------------------------------------
     | HTTPS Only Cookies

modules/backend/classes/Controller.php

@@ -277,6 +277,7 @@ class Controller extends ControllerBase
         if ($ajaxResponse = $this->execAjaxHandlers()) {
             $result = $ajaxResponse;
         }
+
         /*
          * Execute postback handler
          */
@@ -287,6 +288,7 @@ class Controller extends ControllerBase
         ) {
             $result = $handlerResponse;
         }
+
         /*
          * Execute page action
          */