Even the first one only works if there's no need to have site-wide user authentication on the domain, because you can't have a domain cookie accessible from sub

Even the first one only works if there's no need to have site-wide user authentication on the domain, because you can't have a domain cookie accessible from subdomains anymore otherwise.