set token in domain wide cookie