Use SameSite Lax for session cookie

When a user browses to a page from another site, for example via a
shared link we want the browser to send the session cookie so that
the page renders as the user and not confusingly being logged out.

This may cause CSRF vulenrabilities, later work to add CSRF tokens
should be considered.

server/utils/signed-cookie.ts

@@ -25,7 +25,7 @@ export async function setSignedCookie(event: H3Event, name: string, value: strin
 	const secret = await useCookieSecret(event);
 	const signature = await crypto.subtle.sign("HMAC", secret, Buffer.from(`${name}=${value}`));
 	const cookie = `${value}.${Buffer.from(signature).toString("base64url")}`
-	setCookie(event, name, cookie, { httpOnly: true, secure: true, sameSite: true, maxAge });
+	setCookie(event, name, cookie, { httpOnly: true, secure: true, sameSite: "lax", maxAge });
 }
 
 export async function getSignedCookie(event: H3Event, name: string) {