Support samesite option in AuthtktAuthenticationPolicy and CookieCSRFStoragePolicy

[mcdonc]

See #2733

[stevepiercy]

It would be good to add a mention of what are same site cookies, why a developer would want to use them, and what the setting does in the narrative documentation. Perhaps in Security?

Are we going to support Lax only, or Strict, too?
#2733 (comment)

Finally perhaps linking to the change in WebOb would be useful?
#2733 (comment)

[mmerickel]

Move the version info down to a `.. versionchanged:: 1.10directive at the bottom of the docstring and document it as "Added thesamesite`` option and made the default ``'Lax'``." similar to below in the csrf storage policy.

[mmerickel]

Document that the default value was changed to Lax.

[mmerickel]

@stevepiercy

It would be good to add a mention of what are same site cookies, why a developer would want to use them, and what the setting does in the narrative documentation. Perhaps in Security?

This is fine but I don't think it's required for this PR. That has more to do with speculative best practices and hardening like #1845 is requesting.

Are we going to support Lax only, or Strict, too?

lax/strict is not something to "support", it's just something that gets set on the cookie and the browser handles.

Finally perhaps linking to the change in WebOb would be useful?

I don't think that's useful.

[digitalresistor]

@mcdonc please run the following commands:

git checkout master
git fetch --all
git stash -u
git reset --hard origin/master

So next time you branch from master it doesn't contain all of the merges you've made in the mean time.

[AvnerCohen]

Is this expected to be released any time soon ?

[stevepiercy]

@AvnerCohen no hard date yet. Progress on the release of Pyramid 1.10 is tracked in its milestone. The four "docs" tagged issues are nearly complete or will be dropped from the milestone. Other issues are in progress. Feedback is sought.