Is any of this actually needed anymore? Setting the SameSite attribute on the cookie will ensure the browser will not send it for cross-site requests, so... problem solved?