added new requirements for lessons and units

Signed-off-by: Kenneth Obsequio <k80308392@gmail.com>

services/trustedDevice.service.js

@@ -37,10 +37,14 @@ const getFingerprintHash = (req) => {
   return crypto.createHash('sha256').update(`${browser}|${os}|${device}`).digest('hex');
 };
 
+// sameSite:'none' (not 'strict') in production — the frontend (Vercel) and
+// this API (Render) are different sites, so this cookie only travels on the
+// cross-site fetch/XHR calls the frontend makes if SameSite allows it.
+// 'none' requires secure:true, which is already forced above in production.
 const cookieOptions = (maxAge) => ({
   httpOnly: true,
   secure:   process.env.NODE_ENV === 'production',
-  sameSite: process.env.NODE_ENV === 'production' ? 'strict' : 'lax',
+  sameSite: process.env.NODE_ENV === 'production' ? 'none' : 'lax',
   maxAge,
 });