CSRF interferes with auth cookie settings

[patrickvuarnoz]

Describe the bug

When CSRF is ON it directly starts a session if none is present and active (via CSRF::init()). This is done very early in the code. A later call to auth()->login() from a controller will call User::__construct() where the session should be initialized for auth. At that point the session is already running and state of the session is PHP_SESSION_ACTIVE. By that, the parts of the code in the User class that would set the cookie params are never being called (lines 43-46).

To Reproduce

Steps to reproduce the behavior:

1. Clear existing cookies in the browser

2. Enable CORS

3. Set cookie settings to ['secure' => true, 'httponly' => true, 'samesite' => 'lax']

4. Perform a login

5. Check the cookie settings in the browser, they will be ['secure' => false, 'httponly' => false, 'samesite' => '']

Expected behavior

The expectation would be, that if cookie settings are present, that those are respected for the session.