It looks like the fixes they have are messy (sending a header for each element in the path * each cookie key) and even then don't work in all browsers. Better to just not use subdomains for arbitrary hosting.