ASP.NET Identity cookie authentication fails for sub-domain authentication

We're using ASP.NET Identity but have make a very small extension to the cookie authenticator to enable sub-domain authentication i.e. we set the auth cookie to bear a hostname like .domain.com (note the preceding dot) instead of domain.com or my.domain.com. We do it so the user is authenticated the domain and all subdomains hosted by that single ASP.NET MVC 5 app.
Problem
On the very FIRST attempt after app cold start, the cookie STILL bears the domain my.domain.com (our logins are on my.domain.com) DESPITE setting it to .domain.com
after executing the SubdomainCookieAuthentication code below. We've confirmed that even on the 1st cold boot the code indeed sets the right domain in the cookie (stepped via  breakpoints in code below) but the cookie that reaches the client doesnt have it. On 2nd and subsequent attempts, the ...