Update CHANGES.rst and add explenation on SameSite cookie

doc/CHANGES.rst

@@ -18,6 +18,9 @@ http://docs.zope.org/zope2/
 - Removed docstrings from some methods to avoid publishing them.  From
   Products.PloneHotfix20160419.  [maurits]
 
+- Add support to SameSite cookie in ``ZPublisher.HTTPResponse``:
+  https://tools.ietf.org/html/draft-west-first-party-cookies-07
+
 
 2.13.24 (2016-02-29)
 --------------------

src/ZPublisher/HTTPResponse.py

@@ -903,6 +903,10 @@ class HTTPResponse(BaseResponse):
                 # and block read/write access via JavaScript
                 elif name == 'http_only' and v:
                     cookie = '%s; HTTPOnly' % cookie
+                # Some browsers recognize the SameSite cookie attribute
+                # and do not send the cookie along with cross-site requests
+                # providing some protection against CSRF attacks
+                # https://tools.ietf.org/html/draft-west-first-party-cookies-07
                 elif name == 'same_site':
                     cookie = '%s; SameSite=%s' % (cookie, v)
             cookie_list.append(('Set-Cookie', cookie))