"SameSite" cookie feature (from issue #982)

[provinzkraut]

As mentioned in #982, set_cookie() does not support the "SameSite" cookie attribute.
This is because the http.cookies module doesn't support that either.
A reason for this isn't really given. It's just that the module was based on RFC 2109 which "SameSite" is not a part of.
In the python repository changes have been made and a pull request opened (python/cpython#214) so that http.cookies could eventually support "SameSite" natively in 3.7.

However, since this is future stuff it doesn't really make a difference for bottle at the moment and i've come to the conclusion that it would be feature that's nice to have.

So i've added this feature to bottle, and updated the docs.

It doesn't to much, i just import the _reserved dict in which valid attributes for cookies are stored,
set_cookie() now supports the keyword same_site and raises aCookieErrorif the value forsame_siteisn'tstrictorlax`.

This mimics petty much what the requested change for http.cookies in 3.7 would do.

[defnull]

This is a reasonable workaround. Thanks :)

We just have to remember adding a feature-gate as soon as python supports this natively.

[provinzkraut]

It was my pleasure.. (=

I'm watching the open pull request anyway, so i'll have that in mind if the time has come.