Enhance Auth Session Cookie Security

[BlairCurrey]

Auth sessions were moved into Redis which took the session content out of the cookie that gets sent to the client (leaving just the identifier). In fixing some aspects of this, we found that we could beef up security measures in a few additional ways:

• Use the secure flag in koa-session. May need to use ngrok/tunnelmole, etc. to validate it's working as intended from localhost. Note auth helm chart NODE_ENV is development. Might need to be updated if checking for production here or elsewhere with these settings.
• Apply the appropriate SameSite attribute (if different than the current default). I don' think strict will work.
• Ensure httpOnly cookies are set (should already be the case)
• Prefix with __Secure- (or probably even better) __Host-. This depends on the secure flag and would require the same sort of local setup to test.

More info on these settings: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#attributes