I am trying to set up the following:
auth.example.com sub1.example.com sub2.example.com
If the user visits sub1.example.com or
sub1.example.com
Try using:
session.cookie_domain = "example.com"
Instead of:
session.cookie_domain = ".example.com"
Note the missing period at beginning.
Be careful using this, though, because it is not supported by all browsers.