Separating api. and www. makes authentication messier (thus less secure). [At least I haven't seen a clear and good one yet.] And with HTTP/2 you don't have to

Separating api. and www. makes authentication messier (thus less secure). [At least I haven't seen a clear and good one yet.] And with HTTP/2 you don't have to worry about static stuff slowing down or crowding out API req-resp data.