change password API; domain on session cookie