Secure (only sent over https, or localhost on http) is the default. This overrides that and
removes the Secure attribute from the cookie.
The default SameSite policy is Lax if one is not explicitly set. See the SameSite section in https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#attributes.