fix(cookies): set cookie on top allowed domain

Set cookie directly if it's IPv4, localhost, or a manually set domain
Otherwise, recursively try to set top domain until it's allowed.
For example:
foo.bar.com, baz.foo.com, foo.com
Initially tries to set cookie on .com and it'll fail, so it tries on .foo.com and it passes
All three get the cookie set on .foo.com

Closes CLT-445