Set COOKIE_SECURE to true in env var to set session and CSRF cookies to secure, only passed over https. Also added CSRF_COOKIE_SAMESITE example to local.py.example