Cookie used to send auth token to front-end after SAML sign-on scoped to wrong domain

[ryanhofdotgov]

After successful SAML sign-on, the backend sets a cookie in the redirect response, but the cookie is scoped to the fully-qualified domain name (FQDN) of the frontend. The backend has no authority to do that, and so the browser does not expose the cookie to the frontend on the subsequent request.

I believe that this wasn't caught during the initial development because testing was done using localhost as the FQDN for the frontend and backend.