Consider marking the IdentityServer session cookies with __Host prefix

[AndersAbel]

The __Host prefix enforces security rules on the cookie. Consider renaming both the main Identityserver session cookie idsrv and the temp external cookie to add the __Host prefix.

The __Host prefix does not interfere with cross site usage for front channel logout or session management, so it shouldn't break anything.

It would however enforce deployment best practices:

• Having IdentityServer as an own host
• Always use https.