This. No cookies should be cross-site visible, ever, unless I explicitly choose for them to be.