James A. Donald writes: > Presumably cookie scope would also be same origin Presumably, but very often not in fact. In the Set-Cookie: header you can specify a broader scope for cookies, and people often do. I raised the issue not knowing/remembering that the WUI does not use cookies, so it's moot here.