Exactly - if you have a combination of trusted and untrusted subdomains, like www.mysite.com support.mysite.com wordpress.mysite.com Then it's impossibl

Exactly - if you have a combination of trusted and untrusted subdomains, like www.mysite.com support.mysite.com wordpress.mysite.com Then it's impossible to give only certain ones access to your session cookie. You could use *.secure.mysite.com for all internal apps, but that seems ugly. You could also not use subdomains for any internal apps, like Google, but that's limiting in other ways - notably, it makes it impossible to have any security isolation between internal apps.