You could do something similar to how FF implemented their new cookie isolation. Make the key (original domain ^ final CNAME). Which probably would still have

You could do something similar to how FF implemented their new cookie isolation. Make the key (original domain ^ final CNAME). Which probably would still have issues, but I think it's worth looking into.