fix: improve cookie handling in chat and login views for HTTPS support

[shaohuzhang1]

fix: improve cookie handling in chat and login views for HTTPS support

[shaohuzhang1]

Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information

[Copilot]

🟢 Ready to approve

The changes are small, localized, and correct the invalid SameSite=None + non-secure cookie combination that modern browsers reject.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

This PR adjusts how the mk_file_auth cookie is set in both the admin login flow and the chat anonymous-auth flow to better support HTTPS vs. non-HTTPS environments, avoiding browser rejection of SameSite=None cookies when not served securely.

Changes:

• Introduces an is_https flag and uses it to control secure and samesite cookie attributes.
• Switches samesite to "Lax" when not HTTPS, keeping "None" only for HTTPS.
• Minor cleanup of set_cookie call style (explicit key=..., removal of redundant domain=None).

File summaries

File	Description
apps/users/views/login.py	Sets mk_file_auth cookie with SameSite=None only on HTTPS; otherwise uses Lax to prevent browser rejection.
apps/chat/views/chat.py	Applies the same HTTPS-aware mk_file_auth cookie handling for anonymous chat authentication responses.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.