Allow access to session cookie from javascript

This is so we can programmatically add the session token to ajax requests to prevent CSRF. (#88)
gratipay · Jun 29, 2012 · bc3f9bb · bc3f9bb
1 parent 7a9331b
commit bc3f9bb
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/gittip/authentication.py b/gittip/authentication.py
@@ -136,4 +136,4 @@ def outbound(response):
     #cookie['domain']
     cookie['path'] = '/'
     cookie['expires'] = rfc822.formatdate(expires)
-    cookie['httponly'] = "Yes, please."
+    #cookie['httponly'] = "Yes, please."