Fix typos (#5751)

Signed-off-by: cuithon <dscs@outlook.com>

CHANGELOG.md

@@ -61,7 +61,7 @@ future styling).
         |> clear_session()
     ```
 
-    *Note*: because the session id is in a http-only cookie by default, the only way to perform this attack prior to this change is if your application was already vulnerable to an XSS attack, which itself grants more escalated "priveleges” than the CSRF fixation.
+    *Note*: because the session id is in a http-only cookie by default, the only way to perform this attack prior to this change is if your application was already vulnerable to an XSS attack, which itself grants more escalated "privileges” than the CSRF fixation.
 
 ## JavaScript Client Enhancements
   * Only memorize longpoll fallback for browser session if WebSocket never had a successful connection