set cookie domain to allow all subdomains
not using dev mode here