use hostname from auth_url in 3rd party cookie message

fixes #4022