I disagree. The point in either case is to get a cookie of the attacker's choosing accepted as the session identifier for the privileged domain. But even if we

I disagree. The point in either case is to get a cookie of the attacker's choosing accepted as the session identifier for the privileged domain. But even if we consider them separate techniques, the mitigation strategy is identical anyway.