StaffSig: use nocookie domain