auth: source cookie hostname from jfa_url

instead of just applying the cookie to the hostname you accessed jfa-go
on, it is applied to the one you set in jfa-go. The result is you'll
have to login twice if you access on localhost:8056 instead
of accounts.jellyf.in.

pwreset.go

@@ -30,7 +30,7 @@ func (app *appContext) GenInternalReset(userID string) (InternalPWR, error) {
 
 // GenResetLink generates and returns a password reset link.
 func (app *appContext) GenResetLink(pin string) (string, error) {
-	url := app.ExternalHost
+	url := app.ExternalURI
 	var pinLink string
 	if url == "" {
 		return pinLink, errors.New(lm.NoExternalHost)