Default to not specifying a csrf cookie domain if None provided.