SESSION_COOKIE_DOMAIN is now set to the highest level, so sessions apply for all subdomains, which we at least want for the language and API domains. In future if we use a static subdomain, we can customize this so that the static domain is cookie-less