def set_auth_cookie(subject: str | Any, expires_delta: timedelta) -> Response:    access_token = create_access_token(subject, expires_delta)    response = JSONResponse(content={"message": "Login successful"})    # Note: The secure flag on cookies ensures they're only sent over encrypted HTTPS connections. For local development (HTTP) set it to False    response.set_cookie(        key="http_only_auth_cookie",        value=access_token,        httponly=True,        max_age=3600,        expires=3600,        samesite="lax",        secure=True,        domain=None,    )    return response@router.post("/login/access-token")def login_access_token(    session: SessionDep, form_data: Annotated[OAuth2PasswordRequestForm, Depends()]) -> JSONResponse:    """    OAuth2-compatible token login: get an access token for future requests (sent in an HTTP-only cookie)    """    user = crud.authenticate(        session=session, email=form_data.username, password=form_data.password    )    if not user:        raise HTTPException(status_code=400, detail="Incorrect email or password")    elif not user.is_active:        raise HTTPException(status_code=400, detail="Inactive user")    access_token_expires = timedelta(minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES)    return security.set_auth_cookie(user.id, access_token_expires)