- Change cookie SameSite policy from Strict to Lax (Strict blocks media subresources on mobile)
- Decouple Secure cookie flag from APP_ENV:
- Add SECURE_COOKIES config (defaults to true in prod, but can be overridden)
- Allows testing production builds over HTTP (home network)
- Increase gocyclo threshold to 25 to accommodate complex handlers