important "sameSite" attribute missing
An extremely important attribute, "**SameSite**", is missing. 
```
Set-Cookie: foo=bar; SameSite=Strict
Set-Cookie: foo=bar; SameSite=Lax
```

It allows servers to assert that a cookie ought not to be sent along with cross-site requests, which provides some protection against cross-site request forgery attacks (CSRF).

See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie

Shouldn't we add it? Thanks.