Is there a way to make csrf_token Secure and HttpOnly?

[zachliu]

The other two cookies session and remember_token can be set up easily by environment variables:

• REDASH_SESSION_COOKIE_SECURE=true
• REDASH_REMEMBER_COOKIE_SECURE=true

But not the csrf_token. I tried:

• REDASH_COOKIES_SECURE=true
• REDASH_ENFORCE_HTTPS=true
• REDASH_ENFORCE_CSRF=true

None of them worked