session_start() takes its options inline

Session settings had to be applied with ini_set() before session_start(), in the right order, from somewhere that ran early enough — which is why so many applications have a block of session ini calls in a bootstrap nobody wants to touch.

session_start([
    'cookie_httponly' => true,
    'cookie_secure'   => true,
    'cookie_samesite' => 'Lax',   // 7.3
    'use_strict_mode' => true,
    'gc_maxlifetime'  => 1800,
]);

use_strict_mode is the one worth turning on and the one that is off by default: without it PHP accepts a session id it never issued, which is session fixation in one setting. The options apply to this call only, so two entry points with different settings no longer fight over globals.