* check callers should also confirm that this cookie has not expired.
   */
  fun matches(url: HttpUrl): Boolean {
    val domainMatch =
      if (hostOnly) {
        url.host == domain
      } else {
        domainMatch(url.host, domain)
      }
    if (!domainMatch) return false

    if (!pathMatch(url, path)) return false

    return !secure || url.isHttps
  }