no cookie domain by default

CHANGES.rst

@@ -37,6 +37,10 @@ Unreleased
     binary file instead. :issue:`4989`
 -   If a blueprint is created with an empty name it raises a ``ValueError``.
     :issue:`5010`
+-   ``SESSION_COOKIE_DOMAIN`` does not fall back to ``SERVER_NAME``. The default is not
+    to set the domain, which modern browsers interpret as an exact match rather than
+    a subdomain match. Warnings about ``localhost`` and IP addresses are also removed.
+    :issue:`5051`
 
 
 Version 2.2.4