Fixed #15594 -- Corrected typo in the docs on HTTPOnly cookies. Thanks to philwills for the report.

          the domains www.lawrence.com, blogs.lawrence.com and

          calendars.lawrence.com. Otherwise, a cookie will only be readable by

          the domain that set it.

        * Use ``http_only=True`` if you want to prevent client-side

        * Use ``httponly=True`` if you want to prevent client-side

          JavaScript from having access to the cookie.

          HTTPOnly_ is a flag included in a Set-Cookie HTTP response