Secure cookie and redirect settings look correct but one browser still loops

Federated login works in one hostname path but another branded hostname falls into a redirect loop after successful auth.