store the authed users domain instead of the apps client_id in the session cookie