When server set's cookie, it can add domain parameter.
This parameter can also work as wildcard:
.domain.com
then cookie will be available on all domains. ending with .domain.com
Currently framework silently ignores this parameter, and replaces it with current host of the URL, which is wrong.