Since they have no sameSite set, is it that they are not being set in the first place, and therefore the frontend (code that runs in the iframe) gets a null when reading them?