STRICT

Cookies are only sent in a first-party context (i.e. not when following a link to the origin site).