[fix] expand the scope of cookies to domains, to allow cross-hosts authentication