♻️ Minor refactor of auth data-flow.

This fixes many issues related to using penpot on-premise
instances on different domain than localhost. This changes
ensures correct data flow of authenticated and not authenticated
sessions.

backend/src/app/http/session.clj

@@ -58,7 +58,9 @@
     (assoc response :cookies {cookie-name {:path "/"
                                            :http-only true
                                            :value id
-                                           :same-site (if cors? :none :strict)
+                                           :same-site (cond (not secure?) :lax
+                                                            cors?         :none
+                                                            :else         :strict)
                                            :secure secure?}})))
 
 (defn- clear-cookies