OptionaldomainOptionalmaxCookie lifetime; omit for a session cookie.
OptionalnameCookie name (default __Host-token, the most locked-down prefix).
OptionalpathDefault / (mandatory for __Host- names).
OptionalsameNone is not an option - cross-site token cookies are how CSRF happens.
Not allowed with
__Host-names.