added new requirements for lessons and units

Signed-off-by: Kenneth Obsequio <k80308392@gmail.com>

server.js

@@ -105,7 +105,14 @@ app.use(session({
   secret: process.env.SESSION_SECRET || 'change-me',
   resave: false,
   saveUninitialized: false,
-  cookie: { secure: process.env.NODE_ENV === 'production', httpOnly: true, sameSite: 'strict' },
+  // sameSite:'none' (not 'strict') in production — frontend (Vercel) and this
+  // API (Render) are cross-site, so 'strict' drops the cookie on every
+  // fetch/XHR call. 'none' requires secure:true, already set above.
+  cookie: {
+    secure:   process.env.NODE_ENV === 'production',
+    httpOnly: true,
+    sameSite: process.env.NODE_ENV === 'production' ? 'none' : 'strict',
+  },
 }));
 
 // Global rate limiter (1000 req / 15 min)