a bunch of stuff happened. I'll do better next commit...

main.php

@@ -2,7 +2,15 @@
 
 require_once "classes/Base.php";
 
-session_start();
+session_name('DECAUTHY_SESSION');
+session_start([
+    'use_strict_mode' => true,
+    'use_only_cookies' => true,
+    'cookie_httponly' => true,
+    'cookie_secure' => !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off',
+    'cookie_samesite' => 'Lax',
+]);
+header('Cache-Control: no-store');
 
 (new Base())->do();
-?>
+?>