1. headers http header: set-cookie: `samesite`: `samesite=lax`

  2. headers http header: set-cookie: `samesite`: defaults to `lax`