Cookie with SameSite=None requires Secure

[ipoerner]

Mars currently does not set the SameSite attribute for cookies:

mars/session.go

Lines 85 to 93 in 5bad6b4

	return &http.Cookie{
	Name: CookiePrefix + "_SESSION",
	Value: Sign(sessionData) + "-" + sessionData,
	Domain: CookieDomain,
	Path: "/",
	HttpOnly: CookieHttpOnly,
	Secure: CookieSecure,
	Expires: ts.UTC(),
	}

However, Firefox (and possibly also Safari) yield a warning message in that case:

Cookie “MARS_SESSION” will be soon rejected because it has the “SameSite” attribute set to “None” or an invalid value, without the “secure” attribute. To know more about the “SameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite