how to use with HttpOnly:true cookie

[dcarbunescu]

Describe the bug
csrfprotector javascript code fails to get the csrf token from the cookie because it is httponly:true, cannot use it. should we recommend that the field httponly be set to false?

To Reproduce

Expected behavior
csrfprotector javascript code should be able to extract cookie token, i think.

Additional context

• PHP Version (example: php 5.6)
• Framework, if applicable
• Browser

Add any other context about the problem here.