Encrypted cookies, and without the silly session stuff, should still work for subdomains