added CSRF cookie protection

default_config.py

@@ -8,3 +8,7 @@ OAUTH2_AUTH_URL = 'http://localhost:5001/oauth2/authorize'
 OAUTH2_TOKEN_URL = 'http://localhost:5001/oauth2/token'
 OAUTH2_USERINFO_URL = 'http://localhost:5001/oauth2/userinfo'
 
+# CSRF protection
+SESSION_COOKIE_SECURE=True
+SESSION_COOKIE_HTTPONLY=True
+SESSION_COOKIE_SAMESITE='Strict'