__host-jsessionid changes inappropriately

[Cantor, Scott]

> Oh yes, likely for them to do that. Out of curiosity, is there a
> particular reason as to why those settings are disabled by
> default? 
> Is it only because browsers are subject to change at any time
> and having them enabled may cause issues?

At the time, there were extant, though out of date, versions of Safari that were broken if you set SameSite to none, and they behaved worse than if it wasn't set at all. Some Android too, though much older (but also even less controllable given how phones are updated).

I suspect for 6.0 we will flip the default.

Whether there are existing clients likely to have problems is impossible to say, that's why the option is a condition and not a boolean.

-- Scott