I had to patch htsbauth.c (at least in v3.44.1) for it to match cookie domain
names with leading dots correctly (the leading dot is like a wildcard).

Check whether the cookie of interest in your case is one of those with a
leading dot: if so, this might be the problem. 

(When time permits, I'll try to file a ticket for this patch and another patch
regarding wrong referrer.)