Fix Safari dev session cookies in SolidStart v2 templates

[obask]

Problem

The SolidStart v2 with-auth, with-drizzle, and with-prisma templates rely on H3's default session cookie settings. H3 sets session cookies as Secure by default, which is correct for HTTPS but causes problems in Safari during local development on plain http://localhost.

In Safari, this makes login appear broken: the sign-in request succeeds, but the session cookie is not preserved across reloads, so the user is sent back to the login flow. That creates some confusion as these templates do not work.

Fix

Configure the H3 session cookie explicitly in the affected templates:

• keep HttpOnly
• keep Path=/
• use SameSite=Lax
• set Secure only in production
• use a template-specific cookie name to avoid localhost collisions

(I also checked how Better Auth handles the same local-dev case)
Production deployments still receive Secure cookies because secure is enabled when NODE_ENV === "production".

H3 session cookie options are configurable through useSession:
https://h3.dev/examples/handle-session#options

Testing

Before fix in Safari, the session cookie was returned with Secure on http://localhost, and login was not preserved after reload:

Tested the updated with-drizzle template with:

npx degit obask/templates-solid/solid-start-v2/with-drizzle#fix/solidstart-v2-dev-session-cookies my-test-project1
cd my-test-project1
pnpm i
pnpm approve-builds
pnpm dev

After fix, Safari stores the session cookie without Secure in local dev:

I also reloaded the page and confirmed the login session is preserved.

Note: I initially tested this while experimenting with SSR disabled, but the fix works with SSR enabled as well.