Delete session cookie samesite 3.x

[rnewson]

Overview

DELETE /_session does not work if the SameSite attribute is enabled when using browsers that enforce it because we forgot to add the property when deleting the cookie. This PR adds the SameSite attribute if enabled.

Testing recommendations

Enable SameSite, login via the dashboard, then log out. Observe that the AuthSession cookie has a value before log out but not after.

Related Issues or Pull Requests

Checklist

• Code is written and works correctly
• Changes are covered by tests
• Any new configurable parameters are documented in rel/overlay/etc/default.ini
• A PR for documentation changes has been made in https://github.com/apache/couchdb-documentation

[nickva]

Would this also apply when we clear the session on a failed login in

couchdb/src/couch/src/couch_httpd_auth.erl

Lines 448 to 451 in b59d65e

	% clear the session
	Cookie = mochiweb_cookies:cookie(
	"AuthSession", "", [{path, "/"}] ++ cookie_scheme(Req)
	),

[rnewson]

eep, yes. will make new PR's. good catch.