fix: prevent stale htmx cache on login potentially causing csrf issues

addresses #869dd1fch

config/packages/framework.yaml

@@ -9,9 +9,8 @@ framework:
     # Remove or comment this section to explicitly disable session support.
     session:
         handler_id: null
-        cookie_secure: auto
+        cookie_secure: true
-        # cookie_samesite: lax
+        cookie_samesite: lax
-        cookie_samesite: none # this is to make login work in staging environment. to be removed when going live!
 
     #esi: true
     #fragments: true

templates/booking/create/authenticate.html.twig

@@ -45,7 +45,7 @@
                     {% include '_partials/_alert.html.twig' with { 'level': 'error', messages: [ error.messageKey|trans(error.messageData, 'security') ] } %}
                 {% endif %}
 
-                <form action="{{ path('app_login') }}" method="post">
+                <form action="{{ path('app_login') }}" method="post" hx-history="false">
                     <div class="mb-4">
                         <label for="username" class="mb-1 font-semibold text-white">
                             E-Mail:

templates/security/login.html.twig

@@ -11,7 +11,7 @@
                 {% include '_partials/_alert.html.twig' with { 'level': 'error', messages: [ error.messageKey|trans(error.messageData, 'security') ] } %}
             {% endif %}
             <div class="pb-4">
-                <form action="{{ path('app_login') }}" method="post">
+                <form action="{{ path('app_login') }}" method="post" hx-history="false">
                     <div class="mb-4">
                         <label for="username" class="mb-1 font-semibold text-white">
                             E-Mail: