Release v3.4.0

• (@GermanBluefox) Fixed: the access_token cookie of a single sign-on was set without any flags, so page scripts could read it and it was sent along cross-site requests. It is now HttpOnly, SameSite=Lax and Secure on https
• (@GermanBluefox) Fixed: behind a TLS-terminating reverse proxy /sso sent http://.../sso-callback as redirect URI, which did not match the one registered at the identity provider, and refused a redirectUrl with https:. The baseUrl option is now used for the single sign-on too
• (@GermanBluefox) Added: ssoHandoff: 'code' puts only a one-time code into the URL after a single sign-on, the page exchanges it via POST /sso-token. Without it the tokens (?ssoLoginResponse=) and the ID token (?id_token=) are in the URL, as before