To be fair there has been an ugly solution to this recently, the `__Host-` cookie prefix:
https://www.sjoerdlangkemper.nl/2017/02/09/cookie-prefixes/