added new requirements for lessons and units

Signed-off-by: Kenneth Obsequio <k80308392@gmail.com>

middleware/csrf.middleware.js

@@ -28,8 +28,19 @@
 const csurf  = require('csurf');
 const R      = require('../utils/response.util');
 
-/** csurf instance — stores token in a signed cookie */
-const csrfProtection = csurf({ cookie: { httpOnly: true, sameSite: 'strict' } });
+/**
+ * csurf instance — stores token in a signed cookie.
+ * sameSite:'none' (not 'strict') in production — frontend (Vercel) and this
+ * API (Render) are cross-site, so 'strict' drops the cookie on every
+ * fetch/XHR call. 'none' requires secure:true, set alongside it below.
+ */
+const csrfProtection = csurf({
+  cookie: {
+    httpOnly: true,
+    secure:   process.env.NODE_ENV === 'production',
+    sameSite: process.env.NODE_ENV === 'production' ? 'none' : 'lax',
+  },
+});
 
 /**
  * GET /api/csrf-token