cmatheson
commented
11 months ago - samesite: lax is the default in browsers, but getting explicit
- secure: https only (doesn't affect localhost)
- clarifies in the README that the secret should be base64 (this is what we expect in our callback)