Rewrite domain in Set-Cookie response headers

[mwhitworth]

see what other reverse proxies do in this scenario, but setting cookies for a domain that is never explicitly referenced is surprising behaviour