R4: Revert to cookies for subdomain compatibility