Testing something else I noticed this warning in the console: Cookie “CGISESSID” will be soon rejected because it has the “sameSite” attribute set to “none” or an invalid value, without the “secure” attribute. To know more about the “sameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite Filing so we can check if changes need to be made.
I've already fixed this on Bug 25360, although it needs more testing and sign off. I also did a very small patch. The creation of the CGISESSID cookie could/should be refactored to be more maintainable...
*** This bug has been marked as a duplicate of bug 25360 ***