fix anon join/rematch (cookie must not be HTTP only!)

app/controllers/Challenge.scala

@@ -81,7 +81,7 @@ object Challenge extends LilaController {
             AnonCookie.name,
             game.player(owner.fold(c.finalColor, !c.finalColor)).id,
             maxAge = AnonCookie.maxAge.some,
-            httpOnly = true.some)
+            httpOnly = false.some)
         }
       }
     } map { cookieOption =>

app/controllers/Setup.scala

@@ -203,6 +203,6 @@ object Setup extends LilaController with TheftPrevention {
       AnonCookie.name,
       pov.playerId,
       maxAge = AnonCookie.maxAge.some,
-      httpOnly = true.some)
+      httpOnly = false.some)
   }
 }