set SameSite to Strict for session cookie

[jvantuyl]

Currently, a number of browsers complain on page load that our session cookie doesn't specify a SameSite value. While I suppose we might want to have the user's session when it's accessed embedded in some other site, I have my doubts that it's a good default.

To wit, the MITRE lists this in their "Common Weakness Enumeration" (CWE) DB as a "Medium" level risk (as CWE-1275). That leads me to believe that there is probably at least some auditor somewhere that would flag this.

Here is an example of someone asking about these messages in the wild. I propose we adopt the fix from that link. That is, add extra: "SameSite=String" to the end of the @session_options here.

[mcrumm]

Hi @jvantuyl! We set same_site: "Lax" by default for newly generated apps, so I think we are okay here. See #4677 for details. Thanks for the report :)