Investigate rack.session cookie warning

[florianm]

Warning:

Cookie “rack.session” will be soon rejected because it has the “SameSite” attribute set to “None” or an invalid value, without the “secure” attribute. To know more about the “SameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite

Shown when run locally, but not in production. Not sure whether this is worth chasing up before and if it ever becomes a blocker.