Harden local/prod cookie policy and Mongo connection settings

config/cookiesOptions.js

@@ -1,8 +1,12 @@
+const isProduction = process.env.NODE_ENV === "production";
+const forceSecureCookie = process.env.COOKIE_SECURE === "true";
+const secure = forceSecureCookie || isProduction;
+
 const cookiesOptions = {
-    maxAge: 1000 * 60 * 60 * 24 * 90, // would expire after 30 days
+    maxAge: 1000 * 60 * 60 * 24 * 90, // would expire after 90 days
     httpOnly: true, // The cookie only accessible by the web server
-    sameSite: 'none', // This and secure are required for properly 
-    secure: true,     // manage cockies in cros-domain
+    sameSite: secure ? 'none' : 'lax',
+    secure,
 };
 
-module.exports = { cookiesOptions };
+module.exports = { cookiesOptions };