Cookie session when API is on different domain - Supabase