getCookieDomain() returns '.localhost' for hostnames ending in '.local' (e.g., app.plunk.local), causing the browser to reject the cookie because the domain doesn't match the request origin. Split the .localhost and .local cases so that .local hostnames return the actual base domain (e.g., .plunk.local).