Improve cookie security

[alexec]

After investigating SSO, I think we need to improve this:

• Remove display the cookie from the login page.
• Set-up flags, []string{"path=/", "SameSite=lax", "httpOnly"} but not Secure.

@alexmt why does Argo CD use "lax" not "strict"?

OSWAP

This is probably the most secure configuration we have for
now:
Set-Cookie: __Host-SessionID=3h93...;Path=/;Secure;HttpOnly;SameSite=Strict

[alexec]

@jannfis @alexmt FYI

[alexec]

ok, we don't currently need to set path, because we set the cookie client side in javascript