A private registry login is successful and image pulls still return 401

Credentials are accepted, yet the follow-up token exchange misses the session because the cookie was scoped to the wrong host during the redirect chain.