Clarifying my comment re. `document.cookie` restrictions