fix: scope session cookie name per instance to prevent CSRF 422s

[MatthewSuttles]

Problem

A second Hivemind instance created via hivemind new (#363) cannot sign in. Devise returns HTTP 422 "Can't verify CSRF token authenticity" on POST /users/sign_in.

Root cause

It's a session-cookie collision, not a real CSRF attack:

1. Same cookie name across instances. There was no config/initializers/session_store.rb, so Rails derived the default session key from the app module (module Hivemind) → _hivemind_session. Both the primary and hivemind new instances used that exact name.
2. Different SECRET_KEY_BASE per instance. bin/hivemind correctly generates fresh secrets for each new instance, so the two instances sign/encrypt their session cookies with different keys.
3. Browser cookies are scoped by host, not port. localhost:8080 (primary) and localhost:8081 (new instance) share one cookie jar, so both write a cookie literally named _hivemind_session and overwrite each other.

Result: loading one instance stomps the other's session cookie. On POST, the form's authenticity token no longer matches the (now-foreign, undecryptable) cookie → 422. This is why it's always the most recently loaded instance that fails.

Fix

Add config/initializers/session_store.rb that keys the session cookie on COMPOSE_PROJECT_NAME, which is already unique per instance (hivemind vs hivemind-<name>) and passed into the Rails container via env_file: .env:

Rails.application.config.session_store :cookie_store,
  key: "_#{ENV.fetch('COMPOSE_PROJECT_NAME', 'hivemind')}_session"

The primary keeps _hivemind_session via the default fallback, so existing sessions are not invalidated. New instances get _hivemind-<name>_session, isolating cookies even on a shared localhost.

Testing

• Confirmed no code hardcodes the old _hivemind_session cookie name (Action Cable, mobile views, etc. all read from the session abstraction).
• Manual: sign into both the primary and a hivemind new instance in the same browser — both now hold independent sessions.

🤖 Generated with Claude Code