Alternative for pikvm/kvmd#138: httponly=True, samesite=Strict

We don't use secure=True because there is a use case with disabled HTTPS.

Thanks @ssza

kvmd/htserver.py

@@ -167,7 +167,7 @@ def make_json_response(
     )
     if set_cookies:
         for (key, value) in set_cookies.items():
-            response.set_cookie(key, value)
+            response.set_cookie(key, value, httponly=True, samesite="Strict")
     return response