base url and cookie host (fixed bug)