allow response cookies and fix their domain