Set session cookies with `SameSite=Lax`

[charmander]

This has been the default in Chrome since version 80, and I didn’t think we’d even have to do it ourselves for that reason, but other browsers haven’t followed suit.

Helps reduce the impact of [redacted].