Setting SameSite on the session cookie?

[eliben]

The userinfo example stores state in a cookie but doesn't set a SameSite attribute on the cookie.

Is there a reason not to do so for better security?