Add CSRF_COOKIE_HTTPONLY note to CSRF AJAX docs

[Andrew Charles]

​https://docs.djangoproject.com/en/dev/ref/settings/#csrf-cookie-httponly
​https://docs.djangoproject.com/en/dev/ref/csrf/#ajax

There should be a note in the CSRF AJAX docs that the CSRF_COOKIE_HTTPONLY setting will prevent non-safe ajax calls from working (if using the js provided). It should note that you have to include the csrf token via the template tag {% csrf_token %}, and update the js with something like this:

var csrftoken = getCookie('csrftoken');
if (csrftoken === null) {
    csrftoken = $('input[name="csrfmiddlewaretoken"]').val();
    if (csrftoken === null) {
        console.log('No csrf token');
    }
}

This is my first Django issue/ticket, sorry if I missed anything.

[Tim Graham]

It seems fine, but allegedly CSRF_COOKIE_HTTPONLY ​doesn't provide any additional security. So I'm not sure if we're wasting our time enhancing its documentation rather than deemphasizing it in the documentation (or even removing it)?