How is the resolved Cookie Domain determined for a Single Sign On (fka SiteMinder) Agent?