docs: def set_cookie(self, name, value, secret=None, digestmod=hashlib.sha256, **options):
          """ Create a new cookie or replace an old one. If the `secret` parameter is
              set, create a `Signed Cookie` (described below).
  
              :param name: the name of the cookie.
              :param value: the value of the cookie.
              :param secret: a signature key required for signed cookies.
  
              Additionally, this method accepts all RFC 2109 attributes that are
              supported by :class:`cookie.Morsel`, including:
  
              :param max_age: maximum age in seconds. (default: None)
              :param expires: a datetime object or UNIX timestamp. (default: None)
              :param domain: the domain that is allowed to read the cookie.
                (default: current domain)
              :param path: limits the cookie to a given path (default: current path)
              :param secure: limit the cookie to HTTPS connections (default: off).
              :param httponly: prevents client-side javascript to read this cookie
                (default: off, requires Python 2.6 or newer).
              :param same_site: disables third-party use for a cookie.
                Allowed attributes: `lax` and `strict`.
                In strict mode the cookie will never be sent.
                In lax mode the cookie is only sent with a top-level GET request.
  
              If neither `expires` nor `max_age` is set (default), the cookie will
              expire at the end of the browser session (as soon as the browser
              window is closed).
  
              Signed cookies may store any pickle-able object and are
              cryptographically signed to prevent manipulation. Keep in mind that
              cookies are limited to 4kb in most browsers.
  
              Warning: Pickle is a potentially dangerous format. If an attacker
              gains access to the secret key, he could forge cookies that execute
              code on server side if unpickeld. Using pickle is discouraged and
              support for it will be removed in later versions of bottle.
  
              Warning: Signed cookies are not encrypted (the client can still see
              the content) and not copy-protected (the client can restore an old
              cookie). The main intention is to make pickling and unpickling
              save, not to store secret information at client side.
          """
          if not self._cookies:
              self._cookies = SimpleCookie()
  
          # To add "SameSite" cookie support.
          Morsel._reserved['same-site'] = 'SameSite'
  
          if secret:
              if not isinstance(value, basestring):
                  depr(0, 13, "Pickling of arbitrary objects into cookies is "
                              "deprecated.", "Only store strings in cookies. "
                              "JSON strings are fine, too.")
              encoded = base64.b64encode(pickle.dumps([name, value], -1))
              sig = base64.b64encode(hmac.new(tob(secret), encoded,
                                              digestmod=digestmod).digest())
              value = touni(tob('!') + sig + tob('?') + encoded)
          elif not isinstance(value, basestring):
              raise TypeError('Secret key required for non-string cookies.')
  
          # Cookie size plus options must not exceed 4kb.
          if len(name) + len(value) > 3800:
              raise ValueError('Content does not fit into a cookie.')
  
          self._cookies[name] = value
  
          for key, value in options.items():
              if key == 'max_age':
                  if isinstance(value, timedelta):
                      value = value.seconds + value.days * 24 * 3600
              if key == 'expires':
                  if isinstance(value, (datedate, datetime)):
                      value = value.timetuple()
                  elif isinstance(value, (int, float)):
                      value = time.gmtime(value)
                  value = time.strftime("%a, %d %b %Y %H:%M:%S GMT", value)
              # check values for SameSite cookie, because it's not natively supported by http.cookies.
              if key == 'same_site' and value.lower() not in ('lax', 'strict'):
                  raise CookieError("Invalid attribute %r" % (key,))
              if key in ('secure', 'httponly') and not value:
                  continue
              self._cookies[name][key.replace('_', '-')] = value