I think the public suffix list only works exactly one level down (otherwise you wouldn't be able to share cookies with sub-levels that _should_ be able to share

I think the public suffix list only works exactly one level down (otherwise you wouldn't be able to share cookies with sub-levels that _should_ be able to share cookies). Thus, with `github.io' on the list, everything on `*.github.io' can't share with each other, but everything on `*.a.github.io' _can_. The author is sharing between `private-org.github.io' and `private-page.private-org.github.io', which is allowed because `private-org.github.io' (or the more general `*.github.io') isn't on the list.