support samesite xsrf cookie

A somewhat more recent approach to CSRF is setting samesite=strict on a cookie. SameSite is handy because it allows the browser to enforce the same-site-ness of a request, without needing application code to send the token separately. SameSite can be used almost everywhere, but not quite. It would be handy to support this strategy of csrf checking (cookie is present and samesite=strict) as equivalent to the current check of token delivery by both cookie and argument.

If I wanted to adopt this strategy now, do you suppose it would be preferable to:

1. create a new samesite cookie for this purpose and implement my own handling, or
2. modify tornado's xsrf handling to attempt to apply samesite restrictions on the cookie

?

Unfortunately, only Python 3.8 has support for setting samesite cookies in the stdlib. This is easily patched (Morsel._reserved['samesite'] = 'SameSite'), but needing a patch is never great.

Start with Tornado's existing XSRF handling and compare it with Python's cookie support for SameSite attributes, including the compatibility limitation described in the issue. Determine whether SameSite=Strict should be treated as equivalent to the current cookie-and-argument token check, and define the supported behavior and compatibility requirements before implementation.