set cookie options

app/__init__.py

@@ -27,6 +27,12 @@ def create_app():
     login_manager.login_view =  'logic.login' # redirect here if not logged in
     login_manager.init_app(app)
 
+    app.config.update(
+            SESSION_COOKIE_SECURE=True,
+            SESSION_COOKIE_HTTPONLY=True,
+            SESSION_COOKIE_SAMESITE='Lax',
+            )
+
     @login_manager.user_loader
     # tells flask how to load a user from the db
     def load_user(id):