the extra dot should not be the problem, i found out it comes from explicitly setting the domain with -domain. With the leading dot the cookie is sent back to www.jala-mi.org or any domain ending in .www.jala-mi.org like subserver.www.jala-mi.org