[java-sig-commits][Bug 1222923] CVE-2015-2156 netty: HttpOnly cookie bypass