I think this needs to be a little more sophisticated to prevent a site from setting a cookie for a TLD, although that would be somewhat difficult to exploit. [nsIEffectiveTLDService](https://developer.mozilla.org/en-US/docs/XPCOM_Interface_Reference/nsIEffectiveTLDService?redirectlocale=en-US&redirectslug=nsIEffectiveTLDService) might be useful here.