Set SameSite=Lax on the session cookie

Applied at all seven session_start sites. keepalive.php and guest_post.php
had no cookie flags at all and now set httponly and secure too.

keepalive.php

@@ -4,5 +4,12 @@
 // Receives requests via AJAX in the background every 8 mins to prevent PHP garbage collection ending sessions
 //  See footer.php & js/keepalive.js
 
+require_once __DIR__ . "/config.php";
+
+ini_set("session.cookie_httponly", true);
+ini_set("session.cookie_samesite", "Lax");
+if ($config_https_only) {
+    ini_set("session.cookie_secure", true);
+}
 session_start();
 session_write_close();