extract Flask app config out of app.py into config.py

notably, this now disables the request cache during tests

app.py

@@ -1,4 +1,6 @@
 """Main Flask application."""
+from pathlib import Path
+
 from flask import Flask
 from flask_caching import Cache
 import flask_gae_static
@@ -14,12 +16,8 @@ import common
 
 app = Flask(__name__, static_folder=None)
 app.template_folder = './templates'
-app.config.from_mapping(
-    ENV='development' if appengine_info.DEBUG else 'PRODUCTION',
-    CACHE_TYPE='SimpleCache',
-    SECRET_KEY=util.read('flask_secret_key'),
-)
 app.json.compact = False
+app.config.from_pyfile(Path(__file__).parent / 'config.py')
 app.url_map.converters['regex'] = flask_util.RegexConverter
 app.after_request(flask_util.default_modern_headers)
 app.register_error_handler(Exception, flask_util.handle_exception)

config.py

@@ -0,0 +1,21 @@
+"""Flask config.
+
+https://flask.palletsprojects.com/en/latest/config/
+"""
+from oauth_dropins.webutil import appengine_info, util
+
+# This is primarily for flashed messages, since we don't use session data
+# otherwise.
+SESSION_COOKIE_SECURE = True
+SESSION_COOKIE_HTTPONLY = True
+# Change to Lax if/when we add IndieAuth for anything.
+SESSION_COOKIE_SAMESITE = 'Strict'
+
+if appengine_info.DEBUG:
+  ENV = 'development'
+  CACHE_TYPE = 'NullCache'
+  SECRET_KEY = 'sooper seekret'
+else:
+  ENV = 'production'
+  CACHE_TYPE = 'SimpleCache'
+  SECRET_KEY = util.read('flask_secret_key')