[tshadwell]

Surely if you were able to do this, you would use it for cookie tossing rather than this simple mischief?

[homakov]

Cookie tossing are not always helpful. If session is properly tied with csrf token there's not much you can do with it.