fix sharing sessions across domains