mpId compatibility with headless shops

[indykoning]

Currently the mpId on an order can only be set via cookies at the moment a cart is being created.
This causes trouble if your frontend is running on another (sub)domain for e.g. headless frontends.

Setting a cookie in this frontend has no effect on the backend, and trying to pass this cookie with e.g. https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/withCredentials is a security concern and violates CORS in most cases.

My suggestion is adding a REST or Graphql endpoint requiring the cart id and mpId, to be able to set this id on the cart even if your backend and frontend are not on the same cookie domain.