docs: correct cookie secure and SameSite defaults #173

src/content/docs/reference/cookies-sessions-tokens.mdx:71-72 says secure is true only in production and sameSite is lax outside it. In the adapters, secure defaults to true always and SameSite derives from it (None when Secure).

• Correct the page now.
• Revisit after the v0.24 CSRF change, which moves the default to SameSite=Lax.

The review found no docs page that recommends something less safe than the SDK default.

Source

Internal security review of 2026-11-09 (doc claims table), read at 9cbc4fc. Found by reading code; nothing was executed. Status: Reported.