[java-sig-commits] [Bug 1185151] CVE-2014-9635 Jenkins on Tomcat: failure to set httponly flag on cookies