Login form sets cookie for the entire domain