Comments added, along with tiny fixes

public/lucidAuth.login.php

@@ -20,6 +20,8 @@
 			// Save authentication token in cookie
 			$httpHost = $_SERVER['HTTP_HOST'];
 			$cookieDomain = array_values(array_filter($settings->Session['CookieDomains'], function ($value) use ($httpHost) {
+				// Check if $_SERVER['HTTP_HOST'] matches any of the configured domains (either explicitly or as a subdomain)
+				//   This might seem backwards, but relying on $_SERVER directly allows spoofed values with potential security risks
     		return (strlen($value) > strlen($httpHost)) ? false : (0 === substr_compare($httpHost, $value, -strlen($value)));
 			}))[0];
 			setcookie('JWT', $result['token'], (time() + $settings->Session['Duration']), '/', '.' . $cookieDomain);