title: rails session store sets cookie with wrong domain
body: <p>We are using rails with devise to provide user authentication.
  Recently we changed the domain of the cookie_store in the
  session_store configuration to .example.com. Everything worked as
  expected, the cookies are created correctly.</p>
  
  <p>Now in rare cases we get the session cookie with domain
  subdomain.example.com. This happens along with a rack.session cookie
  also with the wrong domain.</p>
  
  <p>Because we can't explain why sometimes the cookie has the full domain,
  we suspect it to be related with the rack.session cookie. We couldn't
  find when the rack.session cookie is set. I logged in in via devise
  and no rack.session cookie was set.</p>
  
  <p>Does anybody had the same error where the session cookie is set under
  the wrong domain? It would be helpful to understand in which cases the
  rack.session cookie is set.</p>