My point was that you don't want the cookie to be sent to other subdomains, so you'd actually want to set the domain to X.y.z. You can't do that if you're web domain is y.z.