ARender Previewer should set Cookie compatible with the iframe integration

While deploying the 10.3.0 to Openshift, we've noticed that the authentication part wasn't working correctly, we ended on an Invalid Credentials error when browsing back to the previewer after the OAuth2 challenge.

This was due to a blocked cookie by the browser because the Set-Cookie header from the previewer response does declare Same-Site: Lax and doesn't declare Secure.
As ARender Previewer is integrated into an iframe inside Nuxeo, the header should declare Same-Site=none; Secure to be accepted by a modern browser.