Comment by preinheimer

But I can throw in an iframe or something to get your browser to make a request against that domain (and get a cookie)