use hostname from auth_url in 3rd party cookie message

fixes #4022
Merge pull request #4024 from seanmonstar/4022-delegated-cookies-message

use hostname from auth_url in 3rd party cookie message