Use "Lax" for cookie "SameSite" restriction, otherwise OAuth2 does no…

…t work

...because the session resets after the redirect, and so the stored nonce/state is lost.

config/initializers/session_store.rb

@@ -1,3 +1,3 @@
 # Be sure to restart your server when you modify this file.
-opts = Rails.env.production? ? { same_site: :strict, secure: true } : {}
+opts = Rails.env.production? ? { same_site: :lax, secure: true } : {}
 Rails.application.config.session_store :cookie_store, **opts