cookie domain must have two parts, so localhost doesn't work

- this only applies to local debugging