see what other reverse proxies do in this scenario, but setting cookies for a domain that is never explicitly referenced is surprising behaviour