FWIW, #1 is both easily fixed and AFAIK mostly already fixed (making cookies additionally scoped by origin of the requesting page, preventing "third-party cooki

FWIW, #1 is both easily fixed and AFAIK mostly already fixed (making cookies additionally scoped by origin of the requesting page, preventing "third-party cookies"). To the extent to which it isn't fixed, it should be fixed at that level.