[vhost] improve cross domain login not to be compromised by browser cache (fix bug 2)