Cookies without SameSite must be secure