The problem is you wrapped the javascript around <vb: literal> tags, which you should do, but that means none of the {vb: raw } tags are being parsed in the script.
Maybe try passing this data through the function?
Code:
<a href="javascript:markAsRead({vb:raw session.sessionurl},{vb:raw bbuserinfo.securitytoken );">{vb:rawphrase mark_forums_read}</a>
Code:
<vb:literal>
<script>
<!--
function markAsRead(session, markreadhash)
{
var markRead= confirm("Do you really want to mark all forums as read?");
if (markRead== true)
{ window.location="forumdisplay.php?" + session + "do=markread&markreadhash=" + markreadhash;
}
else
{
}
}
//-->
</script>
</vb:literal>