[polemic]

The JS can't break out of it's frame, so that doesn't really matter. The cookie comes with the request (image, html or JS, it doesn't matter).

[rhizome]

Gotcha. Interesting.

Thanks to both of you!