fix:auth CSRF

src/lib/server/auth.ts

@@ -70,7 +70,10 @@ export async function invalidateSession(sessionId: string) {
 export function setSessionTokenCookie(event: RequestEvent, token: string, expiresAt: Date) {
 	event.cookies.set(sessionCookieName, token, {
 		expires: expiresAt,
-		path: '/'
+		path: '/',
+		httpOnly: true,
+		secure: false, // Allow HTTP in development
+		sameSite: 'lax'
 	});
 }