Support disable secure for session data

[hezhenxing]

I am writing a service for use within a LAN, session data works fine when accessing the service using localhost or 127.0.0.1, but when accessing the service from another host, or even from the same host using real ip address like http://192.168.1.100:3000, session data will stop working.

[seanhess]

@hezhenxing thanks for reporting this. I'm assuming this isn't a problem for hyperbole.live because it uses https, and there's an exception for http://localhost and http://127.0.01.

Set-Cookie: Secure - makes https required.

Set-Cookie: SameSite=xxx allows you to specify Strict, Lax, or None.

Both of these could be added as configurable properties of Session, with defaults to what they are now