Set SameSite attribute for session cookie

[marein]

We can use the Lax setting because we adhere to the HTTP protocol and don't use secure methods to change data. It looks like this will protect against CSRF attacks, but it doesn't. Normal forms, let's call them pre-auth, like a login or a contact form, still need to be protected.