fix: Separate cookie configuration between session & auth cookies to prevent oauth flow from breaking