server: auth: strictly prohibit cross-site cookie

Flood instances are not going to be linked from another site.

This prevents Cross-Site Request Forgery attacks which exploits
cached authentication token in cookie.

server/routes/auth.js

@@ -22,7 +22,7 @@ const setAuthToken = (res, username, isAdmin) => {
     expiresIn: expirationSeconds,
   });
 
-  res.cookie('jwt', token, {expires: new Date(cookieExpiration), httpOnly: true});
+  res.cookie('jwt', token, {expires: new Date(cookieExpiration), httpOnly: true, sameSite: 'Strict'});
 
   return res.json({
     success: true,