[snack-sdk][website] Move to cookie-based auth

[byronkarlen]

Why

Remove client-side reads of the session cookie. Rely on credentials: 'include' instead.

How

snack-sdk

• added a useCookieAuth option that defaults to false for existing consumers

website

• sets snack-sdk's useCookieAuth to true
• refactored authManager to get rid of legacy auth code, and use credentials: 'include' with direct fetches to website

To make these changes, I had claude audit all of website's requests (either direct or through snack-sdk) to the API server. Then, I had it determine which of these endpoints needed potentially authenticated contexts and added support for credentials: 'include'.

Test Plan

Tested out auth flow locally against local instance of website and staging api. Not super familiar with snack so I'm not confident my QA was comprehensive.

[byronkarlen]

• [website] Fix test failing locally #681
• [snack-sdk][website] Move to cookie-based auth #685 👈 (View in Graphite)
• [snack-sdk][website][snackager] Migrate API server hostname #684
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[ide]

I'm not sure this is right - would state.online be set in the anonymous scenario? Looking at the this.close() call below, we don't send the user anyway when using cookies.

I think the current code works but it ends up being harder to read because of the history of how we ended up here.

Logically it's like we want:

if (useCookieAuth) {
  // cookie-specific logic here...
  this.close(...)
} else {
  // old logic here...
  this.close(...)
}

[byronkarlen]

Yes state.online could be set in the anonymous scenario. Agreed confusing. I just changed it to be clearer. The logic is the same though.