Add security settings to allow the potential for iFraming this application

[jonespm]

This is going to be two steps

• We need to either use CSP (or the older X-Frame-Options) with the domains that we'll be wanting to frame outselves in

• Because Chrome is changing SameSite in Feburary we'll also need to set that to None so cookies are set

If we upgrade to Django 2.1.x+ via #198 we might be able to set this directly, though this isn't merged yet into Django 2.x.

SESSION_COOKIE_SAMESITE=#Get this setting from ENV default to None, possible values are Strict and Lax.

Otherwise we need to use the package and Middleware https://pypi.org/project/django-cookies-samesite/

[mfldavidson]

Just to be clear, this is the issue that we have decided NOT to address any of in this sprint, right @jonespm ?

[mfldavidson]

Ok I'm removing this from the current project because I think this is what we decided to not address in this sprint.

[mfldavidson]

Ok NOW we are going to address it, we are going to have to develop our own fix.

[jonespm]

Not sure if this issue still has any priority so going to un-assign myself for now.