fix(19.3-06): production refuses an inferred insecure token cookie (WR-05)

- LoadCookieConfig refuses a Secure that resolves to false in production,
  also when inferred from an http or unset app.url, naming
  auth.cookie.secure and app.url

docs/services/authentication.md

@@ -75,10 +75,10 @@ This fragment belongs in `config/auth.yaml`. With the block unset the cookie is
 | `auth.cookie.name` | `token` | Cookie name. |
 | `auth.cookie.domain` | empty (host-only) | A parent domain shares the cookie with its subdomains. |
 | `auth.cookie.path` | `/` | Cookie path. |
-| `auth.cookie.secure` | true when `app.url` is https | `false` is refused in the production environment. |
+| `auth.cookie.secure` | true when `app.url` is https | In the production environment a value that resolves to false is refused, whether `false` is set or inferred from an http or unset `app.url`. |
 | `auth.cookie.same_site` | `lax` | `lax`, `strict` or `none`; `none` requires Secure. |
 
-An invalid domain, `same_site: none` without Secure or `secure: false` in production makes `bouncer.LoadCookieConfig` return an error naming the key; return it from your plugin's boot so the application does not start with a cookie browsers would drop.
+An invalid domain, `same_site: none` without Secure, or a cookie that is not Secure in production makes `bouncer.LoadCookieConfig` return an error naming the key. In production that covers `secure: false` and an unset `auth.cookie.secure` with an http or missing `app.url`; that error names `auth.cookie.secure` and `app.url`, and you fix it by setting `app.url` to the public https URL or `auth.cookie.secure: true`. Return the error from your plugin's boot so the application does not start with a cookie browsers would drop or send in clear.
 
 `bouncer.CookieConfig.TokenCookie` builds the cookie for a token and a lifetime. Pass the guard's refresh window (`refresh_ttl`, 20160 minutes by default), not its access `ttl`: the access token inside expires after `ttl`, the frontend's 401 handling then calls the refresh endpoint, and that endpoint needs the cookie to still be there. A cookie that died with the token would force a new sign-in every hour. `bouncer.CookieConfig.ForgetTokenCookie` builds the matching cookie that deletes it; it carries the same name, path and domain, or the browser would keep the original.