Simple fix to avoid further confusion: HOST should be set to mydomain.tld and not localhost since the former is the one taking the sessions.