Hacker News Reader

> It's more secure. If identifying session data is not accessible to JavaScript, it makes a site more secure from XSS attacks.

HTTPOnly should take care of this.

It depends, HTTPOnly cookies are still accessible to JavaScript in some conditions, like those using an Android browser: