Add config option for Secure cookies; fix Chrome warning

The following warning is shown in the developer console for a web client instance:

A cookie associated with a resource at URL was set with SameSite=None but without Secure. A future release of Chrome will only deliver cookies marked SameSite=None if they are also marked Secure. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5633521622188032.

This cookie management setting does not appear to be configurable via the Amplitude JS init options. Appears to be related to issue #239 and the related PR.

Mac Chrome Version 83.0.4103.61 Amplitude JS SDK 6.2.0

---

Somewhat related: to configure the SameSide cookie property, the JS SDK Cookie Management docs note to use option cookieSameSite, but the CHANGELOG.md notes the property is named sameSiteCookie. sameSiteCookie appears to be the correct/working name. The SDK docs should be updated to reflect this?

[blazzy]

Hi @jfroom, The secure flag can be set with the secureCookie option. You might do something like this when initializing amplitude: { secureCookie: window.location.protocol === 'https:' }.

Future versions of the SDK will likely default to SameSite=Lax, but this will might be a slightly breaking change for people that require cross domain form POSTing.

It’s also tempting to have the SDK default to using a Secure cookie if it detects that it’s being loaded on a site with https. This would also be a breaking change for sites that use both https and http.

[dana11235]

Updated the docs to reflect this. Sorry about the error.