[bawolff]

> My cookies are scoped to my own subdomain

If you mean with the domain option, that's not really sufficient. You need to use the Host- prefix