From cf20ce5faef6d0ae95bda49e69a1d81fc15a2d49 Mon Sep 17 00:00:00 2001
From: kelson <kelson@shysecurity.com>
Date: Tue, 18 Aug 2015 12:25:13 -0400
Subject: [PATCH] _js_cookies => not httponly_cookies

---
 gluon/globals.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gluon/globals.py b/gluon/globals.py
index 23f704b0..3fbe42ba 100644
--- a/gluon/globals.py
+++ b/gluon/globals.py
@@ -1029,7 +1029,7 @@ class Session(Storage):
         if self._forget:
             del rcookies[response.session_id_name]
             return
-        if not self._js_cookies:
+        if self.get('httponly_cookies',True):
             scookies['HttpOnly'] = True
         if self._secure:
             scookies['secure'] = True