localhost is also a secure origin by browsers

[segevfiner]

Also partitioned cookies are only allowed with secure, so in secure: 'auto' also set partitioned to false

Checklist

• run npm run test && npm run benchmark --if-present
• tests and/or benchmarks are included
• documentation is changed or added
• commit message and code follows the Developer's Certification of Origin
  and the Code of conduct