the .launchpad.net session cookie, lp should be a httponly cookie

[David]

The session cookie used on launchpad.net called lp for the domain .launchpad.net is a secure cookie but it is not a httponly cookie. If a cookie is httponly then "If a browser that supports HttpOnly detects a cookie containing the HttpOnly flag, and client side script code attempts to read the cookie, the browser returns an empty string as the result" - source http://www.owasp.org/index.php/HttpOnly

This should reduce the potential damage that a xss on a https enabled launchpad.net service would be able to inflect on a user's account.