fix: clear credentials when redirecting to a different port

[flavorjones]

Note that in this case we treat cookies differently from credentials
per RFC 6265 section 8.5:

https://datatracker.ietf.org/doc/html/rfc6265#section-8.5

Cookies do not provide isolation by port. If a cookie is readable
by a service running on one port, the cookie is also readable by a
service running on another port of the same server. If a cookie is
writable by a service on one port, the cookie is also writable by a
service running on another port of the same server. For this
reason, servers SHOULD NOT both run mutually distrusting services on
different ports of the same host and use cookies to store security-
sensitive information.

@kyoshidajp, would love your feedback on this.