If not using the custom domain stuff, cookies need protection via Set-Cookie with `SameSite=Strict`, right? I couldn't see a note in the documentation