Cookie deletion not working on localhost

[bdbergeron]

Recent changes to cookie handling appears to have broken cookie deletion when developing locally and testing on localhost. When the session is invalid and a refresh attempt fails, I'm still seeing the cookie in my browser's dev tools with an encoded value and expiration set over a year in the future.

The error is being logged as follows:

Session invalid. Refreshing access token that ends in hGt09AzLTA
Failed to refresh. Deleting cookie. OauthException: Error: invalid_grant
Error Description: Refresh token already exchanged.
    at Generator.throw (<anonymous>) {
  status: 400,
  requestID: '',
  error: 'invalid_grant',
  errorDescription: 'Refresh token already exchanged.',
  rawData: {
    error: 'invalid_grant',
    error_description: 'Refresh token already exchanged.'
  }
}

I'm using the new authkit() middleware handler and manually handling the authorizationUrl redirect. If I don't manually delete the cookie, attempting to navigate to the returned authorizationUrl results in a redirect to https://error.workos.com/sso. Inspecting the returned authorizationUrl, it appears the redirect_uri query parameter is not included. Once I delete the cookie, the authorizationUrl appears to be correct once again.

Originally posted by @bdbergeron in #171 (comment)