`auth-token` cookie security issues

[isXander]

Please confirm the following.

• I checked the existing issues for duplicate problems
• I have tried resolving the issue using the support portal

What browsers are you seeing the problem on?

No response

Describe the bug

The auth token should be a HttpOnly cookie.

Steps to reproduce

No response

Expected behavior

No response

Additional context

No response

[piprett]

See also #3309 while at it, such that the cookie isn't cross-subdomain.

[isXander]

iOS has strict restrictions on storage for PWAs. If cookies aren't HttpOnly, they're cleared immediately, resulting in sign-out EVERY time you go on the PWA.