make session cookie even more secure

- assert that a cookie ought not to be sent along with cross-site requests
see https://tools.ietf.org/html/draft-west-first-party-cookies-07
- respect cookies with https requests only (although normally the proxy will block
http requests anyway)

lib/Conch.pm

@@ -37,6 +37,8 @@ sub startup {
 
     $self->sessions->cookie_name('conch');
     $self->sessions->default_expiration(86400);     # 1 day
+    $self->sessions->samesite('Strict');            # do not send with cross-site requests
+    $self->sessions->secure(1) if $ENV{MOJO_MODE} eq 'production';  # https only
 
     $self->plugin('Config');
     $self->secrets(delete $self->config->{secrets});