Exploring the SameSite cookie attribute for preventing CSRF
simonwillison.net