Bump servlet-api to 3.1.0, make cookies http only.

This makes them invisible to JavaScript (which we don't use) to avoid the
danger of someone injecting JavaScript somehow and stealing auth cookies. It's
a dangerous world out there.

pom.xml

@@ -44,8 +44,8 @@
   <dependencies>
     <dependency>
       <groupId>javax.servlet</groupId>
-      <artifactId>servlet-api</artifactId>
+      <artifactId>javax.servlet-api</artifactId>
-      <version>2.5</version>
+      <version>3.1.0</version>
       <scope>provided</scope>
     </dependency>
     <dependency>

src/main/java/com/samskivert/servlet/user/UserManager.java

@@ -299,6 +299,7 @@ public class UserManager
         }
         acookie.setPath("/");
         acookie.setMaxAge((expires > 0) ? (expires*24*60*60) : -1);
+        acookie.setHttpOnly(true);
         if (USERMGR_DEBUG) {
             log.info("Setting cookie " + acookie + ".");
         }