@Yoshi lamp told me that it could extract cookies from subdomain hosted things since it was at the apex domain, but realistically i don’t think that’s much of a concern? anyways when i changed it I didn’t copy the old configuration which was some weird regex crap I wrote to extract and rewrite the username from the request, i would probably change it back but i’d need to figure all that out again :p