Session cookie on instance

After hybrid auth, the sid cookie should be set against the instance URL of the authenticated host, not the entire salesforce.com domain.