Merge pull request #1403 from 18F/margolis-1915-lax-cookie

Set SameSite=Lax to fix OIDC CSP issue

config/initializers/secure_headers.rb

@@ -45,7 +45,7 @@
     secure: true, # mark all cookies as "Secure"
     httponly: true, # mark all cookies as "HttpOnly"
     samesite: {
-      strict: true # mark all cookies as SameSite=Strict.
+      lax: true # SameSite setting.
     },
   }