Fix cookie domain for localhost

Web browsers don't appreciate a cookie domain without any dots. This patch detects the originally-requested domain for the request. If the domain does not contain dots (such as 'localhost' or the name of a local server on your network defined in your hosts file), no cookie domain is sent.

The greatest symptom of this issue what the illustrious 'Invalid CSRF token' seen repeatedly on the scp login page. The reason is that the browser was rejecting the cookie from the server.