Right now we rely on SameSite on cookies. See https://caniuse.com/#feat=same-site-cookie-attribute
SameSite