fix: production cookie domain

When user logs in on staging and also on production, production cookie is used instead of staging and on staging it leads to login error, because it uses wrong session cookie.

Login then returns invalid CSRF token, because the authenticity token is associated to session, and production is used instead of staging.