This is really neat! There's growing number of self-hosters that I'm sure will find this useful.

May I suggest using a separate domain for tunnels, and adding it to the [public suffix list](https://github.com/publicsuffix/list)?

From what I can tell, takingnames.io subdomains are able to access the takingnames.io auth cookie. Having a separate domain would mitigate this.