Changed DARTSESSID's httpOnly property to true by default.

sdk/lib/io/http_impl.dart

Index: sdk/lib/io/http_impl.dart
diff --git a/sdk/lib/io/http_impl.dart b/sdk/lib/io/http_impl.dart
index 740dc36d9aca19d335109cae0d3a01c2e46e49d6..cb2c2e0a8c714948cc91a268ae6bbfca75fbeaf4 100644
--- a/sdk/lib/io/http_impl.dart
+++ b/sdk/lib/io/http_impl.dart
@@ -1144,12 +1144,13 @@ class _HttpResponse extends _HttpRequestResponseBase implements HttpResponse {
       for (int i = 0; i < cookies.length; i++) {
         if (cookies[i].name.toUpperCase() == _DART_SESSION_ID) {
           cookies[i].value = session.id;
+          cookies[i].httpOnly = true;
           found = true;
           break;
         }
       }
       if (!found) {
-        cookies.add(new Cookie(_DART_SESSION_ID, session.id));
+        cookies.add(new Cookie(_DART_SESSION_ID, session.id)..httpOnly = true);
       }
     }
     // Add all the cookies set to the headers.