correctly split auth and service domain

cookie should be set on auth domain, but redirect should gio to service domain