samesite flag is needed for the session cookie