We [should probably prefix cookies](https://check-your-website.server-daten.de/prefix-cookies.html) (`__Secure-` for the `ID` cookie, and maybe `__Host-` for any others).