SessionUtils was not setting domain on API session cookie.