Allow for configuration of session secure and samesite attributes

[jrwdunham]

Fixes 51

Rationale

The samesite cookie attribute needs to be set to None in order for Dative to be able to store OLD cookies when the two apps are on different URLs.

Considerations

In prod, session.secure should be True so that cookies only work over HTTPS. However, in local development doing this will break integration tests.

Changes

• Allow for configuration of session secure and samesite attributes.
  • Modify config.ini to accept these values with defaults false and None, respectively.
  • Modify old/__init__.py so that:
  • the env var OLD_SESSION_SECURE can override the config.ini session.secure value, and
  • the env var OLD_SESSION_SAMESITE can override the config.ini session.samesite value.