So I got it to work.

Things I've changed

• Set sameSite to 'Strict'
• Added app.set('trust proxy',1) to app.js

I believe this is either do to using a custom url, and/or render internal handling of requests.