Only setting `Domain=$` for session cookie if `parsed.host` is a valid DNS domain (not a TLD, localhost or an IP)