Don't think of it that way. Think of it as cookie/token spam. Just like email spam, we'll have to employ various tactics in order to fight back. Heuristics, kno

Don't think of it that way. Think of it as cookie/token spam. Just like email spam, we'll have to employ various tactics in order to fight back. Heuristics, known bad-player Databases, punishment and domain-blocking, etc. How likely is it that any mail server will deny mails coming from facebook.com? The ability to "send" your browser tokens should be something that requires a reputation that the various entities/domains have to earn and retain. And if Facebook decides to abuse it, then their domain will start breaking because they rely on cookies.