check for valid cookie domain

- default to empty when invalid