[Ayoub-Mabrouk]

Test setting sameSite to 'strict'
Test setting sameSite to 'lax'
Test setting sameSite to 'none'
Test default value (should be undefined)

[yxshee]

I ran this branch: 151 passing and eslint clean. The four new tests also pass on master, as expected for tests-only.

Like the domain tests in #1101, these read cookie.sameSite, which the constructor's generic for (var key in options) copy sets for any key. I deleted sameSite: this.sameSite from the Cookie#data getter (so SameSite is never serialized) and ran this file: all 22 tests in test/cookie.js still pass. On current master the regression is still caught, but only by 11 sameSite: 'auto' tests in test/session.js.

If the goal is to pin down the Cookie class itself, asserting the serialized value would make these tests catch that, e.g. new Cookie({ sameSite: 'lax' }).serialize('sid', 'x') contains ; SameSite=Lax. The boolean forms are also documented and currently untested at this level: true gives SameSite=Strict and false omits the attribute (both checked on master).

This and #1101 add their blocks at the same place in test/cookie.js, so the second one merged will need a rebase. Merging both onto master gives a conflict.