use a cookie for referrals, so they persist cross domain