getCookieDomain() returns '.localhost' for hostnames ending in '.local'
(e.g., app.plunk.local), causing the browser to reject the cookie
because the domain doesn't match the request origin.
Split the .localhost and .local cases so that .local hostnames return
the actual base domain (e.g., .plunk.local).
