Authorisation cookies should be set with base.url domain name and path if one is available.