Keep HTTP admin and cabinet sessions by not requiring Secure cookies or Origin CSRF.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moniki/web",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "private": true,
   "scripts": {
     "dev": "next dev -p 3000",

apps/web/src/app/api/auth/login/route.ts

@@ -19,7 +19,7 @@ export async function POST(request: Request) {
       httpOnly: true,
       sameSite: "lax",
       path: "/",
-      secure: process.env.NODE_ENV === "production",
+      secure: false,
       maxAge: 60 * 60 * 24 * 7,
     });
     return response;

apps/web/src/app/api/auth/register/route.ts

@@ -28,7 +28,7 @@ export async function POST(request: Request) {
       httpOnly: true,
       sameSite: "lax",
       path: "/",
-      secure: process.env.NODE_ENV === "production",
+      secure: false,
       maxAge: 60 * 60 * 24 * 7,
     });
     return response;