* chore: CSRF protect forgot-password functionality
* feat: implement conditional sameSite cookie setting for CSRF tokens
- Use WEBAPP_URL to determine secure cookie settings
- Set sameSite to 'none' for HTTPS environments to support cross-origin scenarios
- Fall back to 'lax' for HTTP development environments
- Follows patterns from PRs #23439 and #23556
Co-Authored-By: alex@cal.com <me@alexvanandel.com>
* update
* change
* NIT
* minor
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: unknown <adhabal2002@gmail.com>
Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com>