No, you have to secure your blog posts because cookies against the top level domain can be in the request headers sent to the subdomain[1]. It's a bit bizarre

No, you have to secure your blog posts because cookies against the top level domain can be in the request headers sent to the subdomain[1]. It's a bit bizarre you'd blame HTTPS, what is your alternative, don't use https? [1] I say "can" because it depends on how the top level cookie is set, whether the browser respects the secure flag, and individual browser versions.