fix(admin): CSRF cookie sameSite=false for Tor, auth cookie fix, async handlers, validation

src/admin/auth.js

@@ -95,9 +95,9 @@ export function handleLogin(req, res) {
   const { token: signed, jti } = signToken({ role: 'admin' });
   res.cookie(COOKIE_NAME, signed, {
     httpOnly: true,
-    sameSite: 'strict',
+    sameSite: false,
     maxAge: MAX_AGE,
-    secure: process.env.NODE_ENV === 'production'
+    path: '/'
   });
   res.redirect('/');
 }