Update go version to 1.16

This includes a fix for our samesite cookie parsing. The behaviour
changed in 1.16 so that the default value now leaves it empty, so it's
equivalent to not setting it (as per spec)

pkg/cookies/cookies.go

@@ -76,7 +76,7 @@ func ParseSameSite(v string) http.SameSite {
 	case "none":
 		return http.SameSiteNoneMode
 	case "":
-		return http.SameSiteDefaultMode
+		return 0
 	default:
 		panic(fmt.Sprintf("Invalid value for SameSite: %s", v))
 	}