The cookie doesn't allow response on production environment
The scenario is when the backend service based Koajs and Koa-session with the default configuration:

```
app.keys = [process.env.SESSION_SECRET];
const isProd = process.env.NODE_ENV === 'production' ? true : false;
const SESSION_CONFIG: any = {
  key: 'koa:sess',
  maxAge: 1000 * 60 * 60 * 24 * 7, // 7 days
  overwrite: true,
  httpOnly: isProd,
  signed: true,
  rolling: true,
  renew: false,
  secure: isProd,
  sameSite: 'None',
};
```

When the request calling to the endpoint and get an error code 500, it doesn't respond as expected and set the cookie to the browser.
But when removing `secure` and `sameSite`, it's working but the cookie doesn't set to the browser.

