fix cookie hostname for express sessions