Any redirect causes a "*.myshopify.com refused to connect." a 302 error, if called like this:
header('Location: ' . $location);
or "*.myshopify.com redirected you too many times." a 302 error, with echo:
echo "<script>window.location.href='" . $location . "';</script>";
It says SameSite=Lax prevents the cookie from being sent in a cross-site request. But trying to change it with:
header('Set-Cookie: cross-site-cookie=whatever; SameSite=None; Secure');
Yet, still, redirect is not allowed.