Actually, the session ID stuff wasn't quite accurate
Actually, the session ID stuff wasn't quite accurate

The reason for `none` and `duplicate` is so you can find the differences. Setting it to lax would break 3rd party interactions.
twitter/secureheaders