Domain-matching rules are not the same when cookies are served or accepted