fix: popouts and reconnects on Safari over http://localhost failed with "Session id mismatch"

[mariobuikhuizen]

Summary

Reported by the jdaviz team: running jdaviz from the terminal (solara server on http://localhost:<port>) and popping out a viewer gives a spinner, and the console shows ValueError: Session id mismatch.

Cause: Chrome and Firefox accept a Secure cookie from http://localhost, Safari does not (WebKit bug 218980, still open). The server set the session cookie with Secure + SameSite=None on localhost, so Safari never sent it back. The first page load still worked, because a websocket without a cookie falls back to a fresh session id (#379), but a reconnect or an ipypopout popout then reaches the same kernel with a different session id and is refused.

Changes:

• Over plain http the session cookie is now SameSite=Lax without Secure, on localhost too (starlette and flask). That cookie is still sent to an iframe when the embedding page is on localhost as well (same site, the port does not matter). Over https, directly or via x-forwarded-proto, it stays Secure + SameSite=None so cross-site iframes keep working.
• A session mismatch that involves a cookieless session is logged as a warning that explains the missing cookie, instead of as a possible hack attempt (related to Misleading 'hack attempt?' log message when session cookie is unavailable #1147).
• Embed docs updated accordingly.

Supersedes #234.

Tests

• test_session_cookie_attributes (integration, flask + starlette): plain http gives SameSite=Lax without Secure; x-forwarded-proto: https gives Secure + SameSite=None.
• test_session_mismatch_without_cookie_is_not_logged_as_hack_attempt (unit).
• popout_test.py still passes on Chromium. Playwright WebKit cannot run on this machine (missing system libraries), so the Safari behaviour itself was not exercised in a browser here.

🤖 Generated with Claude Code