The cross site requests thing has thankfully been fixed. Modern browsers will soon (or already do?) stop sending another sites cookies when making a request from a different domain.