code: public Cookie createReferrerURLCookie(String cookieName, @Sensitive String url, HttpServletRequest req) {
          if (!webAppSecConfig.getPreserveFullyQualifiedReferrerUrl())
              url = removeHostNameFromURL(url);
  
          return createCookie(cookieName, url, req);
      }
docs: Create the referrer URL cookie.
  This cookie should be session length (age == -1).
  
  @param authResult
  @param url