Use `hostname` when nuking cookies

Unlike `hostname`, `host` contains the port as well, and therefore it
won't clear cookies set to eg. `localhost`, when the app is actually
running on `localhost:3000`.