update auth cookie settings

webcontroller/user_account.go

@@ -180,7 +180,13 @@ func (wc *WebController) loginForm(td *TemplateData, r *http.Request) (f Form) {
 				Path:    "/",
 				Expires: time.Now().AddDate(50, 0, 0),
 				Domain:  wc.sessionCookieDomain,
-				SameSite: http.SameSiteStrictMode,
+
+				// Strict means the Cookie will only be sent when the user
+				// reaches a page by a link from the same domain. Lax means any
+				// page on the domain gets the cookie and None means embedded
+				// content also gets the cookie. We're not trying to track the
+				// user around the web so we use lax
+				SameSite: http.SameSiteLaxMode,
 			}
 			f.Extra.RedirectTo = "/user"
 		}