Comment by qabqabaca

> This made it difficult to work with separate hosts (www.my.app vs. api.my.app).

This is still possible with session cookies if you use wildcard origin cookies i.e. *.my.app