In that case either automatically ignoring the cookie or displaying the equivalent of the "this certificate is invalid" warning would be workable. It's a compro

In that case either automatically ignoring the cookie or displaying the equivalent of the "this certificate is invalid" warning would be workable. It's a compromise. Personally, I believe nothing of value would be lost if browsers simply enforced originOnly period (without supporting anything else).