CWE-1275: Sensitive Cookie with Improper SameSite Attribute

Set the SameSite attribute of a sensitive cookie to "Lax" or "Strict". This instructs the browser to apply this cookie only to same-domain requests, which provides a good Defense in Depth against CSRF attacks. When the "Lax" value is in use, cookies are also sent for top-level cross-domain navigation via HTTP GET, HEAD, OPTIONS, and TRACE methods, but not for other HTTP methods that are more likely to cause side-effects of state mutation.