FYI: Chrome plans to ship an implementation of same-site cookies.

Hello, HTTP WG folks who are interested in cookies. :)

We've talked on and off about same-site cookies as a defense in depth
against CSRF and related attacks; I think they're solidly enough defined to
ship and let folks begin experimenting with. We plan on pushing them out
the door in Chrome ~51, and I hear that folks at Mozilla are planning on
beginning an implementation in Q2:

Spec: https://tools.ietf.org/html/draft-west-first-party-cookies

Intent to Ship:
https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/csCtW3M3-wg

There's a very slightly updated -07 that I'll upload once things open up
again, but it doesn't contain any normative changes. Feedback on the
existing text (or Chrome's implementation) would be much appreciated.

-mike