Validate the domain name less strictly.
Account for the logout cookie on the path oauth2/authorize.