fixed a circumvention approach: calling iframe's contentDocument.cookie will return the cookie value without being spotted.