Clarify some points around the cookie domain

Also add a check that the domain has a dot. This covers the localhost
case as well, so remove that.