cookies: support the publicsuffix list

will work on domains like myapp.herokuapp.com.

cc @ianstormtaylor @lancejpollard