For same domain requests even with iframe the cookies are sent. I'm more worried about the fact that it may break cross domain authentication, though most authe

For same domain requests even with iframe the cookies are sent. I'm more worried about the fact that it may break cross domain authentication, though most authentication frameworks support passing state through the authentication mechanism.