Session cookies are host-only. The cookie holding your access token, refresh token, and signing key is no longer sent to every subdomain, and its name now makes the browser enforce that rather than leaving it to this code to keep getting right.