SameSite cookie

A cookie attribute controlling whether the cookie is attached to requests originating from other sites: `Strict` never, `Lax` only on top-level navigations, `None` always but only over HTTPS. `Lax` is now the default, which removed most cross-site request forgery by default and broke a generation of embedded widgets and payment redirects at the same time. It is a defence in depth, not a replacement for a CSRF token on state-changing requests.