small documentation update to outline caveat with SESSION_COOKIE_DOMAIN