[Pushed] mybbuser cookie is set without httponly when changing password

[HellaMadMax]

When changing your password it updates the mybbuser cookie, but doesn't use the "httponly" parameter like other places do (such as when you login). This results in the mybbuser cookie being able to be accessed from javascript.

Link to line causing issue.

[Devilshakerz]

Hi,

Thank you for your report. We have pushed this issue to our Github repository for further analysis where you can track our commits and progress with fixing this bug. Discussions regarding this bug may also take place there too.

Follow this link to visit the issue on Github: https://github.com/mybb/mybb/issues/2705

Thanks for contributing to MyBB!

Regards,
The MyBB Group