Add SameSite Attribute to JWT and Session Cookies

[apcollier-glg]

Our most recent penetration test indicated most of our web apps are vulnerable to cross-site request forgeries (CSRF's), as they will accept requests from malicious third party domains, provided the proper authentication cookie (jwt) is passed with the request. On the client side, some browsers will readily pass along this authentication cookie with requests from malicious third party domains to our web apps.

This vulnerable behavior can be stopped by adding the SameSite=Lax or SameSite=Strict attribute to the jwt and session cookies in the starphleet JWT overlay. GLG is already operating under some variant of the SameSite regime, as Google has already begun the process of treating all cookies as SameSite=Lax.

My review of our source code and testing of our apps indicates this approach will work, and I am staging this pull request to serve as a reference point for discussion.