I take issue with your cookie site example, because the user of the cookie site is probably using the same credentials on an important, sensitive site.