As long as we serve SPA from the same domain, yes. But it's not what I expect to be the general case (SPA hosted somewhere else) in the far future. Maybe I was thinking too much ahead, I have no strong feeling about this.