Allow response cookie sameSite value "none"

[misschak]

https://web.dev/samesite-cookies-explained

Finally there is the option of not specifying the value which has previously been the way of implicitly stating that you want the cookie to be sent in all contexts. In the latest draft of RFC6265bis this is being made explicit by introducing a new value of SameSite=None. This means you can use None to clearly communicate you intentionally want the cookie sent in a third-party context.

Currently setting sameSite to none will produce
TypeError: option sameSite is invalid

[dougwilson]

This is the PR: jshttp/cookie#89

[misschak]

Thanks much!

[dougwilson]

No problem! The PR has been merged and released upstream. I have included the updated dependency in the 4.17 branch, due for imminent release. #3778