I didn't change anything in configs, just upgraded modules. As I understand only csrf option was changed In the new version. I don't use csrf explicitly, only

cookieSameSite

option. Not sure what else I could miss..