The issue is related to a Cross-Site Request Forgery (CSRF) attack. Since the session cookie is not set to `SameSite: strict`, this opens the library up to severe attack possibilities. Any API call can be made via a CSRF attack by an unauthenticated user. For example, an attacker can trick an administrator into visiting a malicious page, which can make a request to `/api/add user/` and add a new administrator to the `pyload` application.