All CLA requirements met.

Also it may solve #201 issue

SameSite=None is still an early draft and breaks Safari. We can't merge that specific behavior until that gets worked out.
dotnet/aspnetcore#12125 (comment)

There are many other places that need to be updated, such as exposing this option for several auth components that emit cookies. SameSite breaks OAuth and OIDC so they need to disable it. Null is OK for them only until the implied default becomes Lax.
https://github.com/aspnet/AspNetKatana/search?q=CookieOptions&unscoped_q=CookieOptions

Hm. System.Web already contains SameSiteMode enum, but it is not available in Microsoft.Owin project.

SameSite breaks OAuth and OIDC so they need to disable it. Null is OK for them only until the implied default becomes Lax.

I'm sorry. I don't quite get what is wrong. If you set to null(or just do nothing) then SameSite would not be included at all as it does right now. Default behavior with default options is not broken.

System.Web.SameSiteMode was added in 4.7.2. Microsoft.Owin targets 4.5.0. We'd probably have to cross compile Microsoft.Owin.Host.SystemWeb to support that.
https://docs.microsoft.com/en-us/dotnet/api/system.web.samesitemode?view=netframework-4.7.2#applies-to

The new SameSite behavior defined in https://tools.ietf.org/html/draft-west-cookie-incrementalism-00 is that Lax becomes the default and you have to specify None to opt out. That default would break OAuth and OIDC unless they opt out, and they can't opt out without breaking Safari.

I'm going to merge this as is and keep iterating. Thanks for getting it started for us.