docs: function _setCookieToken (cookies, cookieName, cookieDomain, token, payload) {
    const parts = token.split('.')
    const opts = { sameSite: 'lax', expires: new Date(payload.exp * 1000) }
    if (cookieDomain) {
      opts.domain = cookieDomain
      // to support subdomains we can't use the sameSite opt
      // we rely on our manual check of the origin
      delete opts.sameSite
    }
    cookies.set(cookieName, parts[0] + '.' + parts[1], { ...opts, httpOnly: false })
    cookies.set(cookieName + '_sign', parts[2], { ...opts, httpOnly: true })
  }