Sure, if you're running entirely separate systems behind each username. But in that case this has been true since XHR first came into existence 15-20 years ago

Sure, if you're running entirely separate systems behind each username. But in that case this has been true since XHR first came into existence 15-20 years ago: https://en.wikipedia.org/wiki/XMLHttpRequest https://en.wikipedia.org/wiki/XMLHttpRequest (sub)domains are a fundamental requirement for web security, they essentially always have been.